Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Latest News

AI Proves Decades-Old Math Problems With Machine-Checkable Results

  The cost of generating new results on some of mathematics’ long-standing open problems has dropped dramatically, with OpenAI claiming tha...

All the recent news you need to know

Phishing-as-a-Service Is Turning Credential Theft Into a Scalable Cybercrime Business

 


Phishing is no longer limited to technically skilled criminals building fraudulent campaigns from scratch. Through phishing-as-a-service (PhaaS), attackers can rent ready-made infrastructure and tools that allow them to impersonate trusted organisations, harvest credentials and target victims at scale.

Phishing attacks use social engineering to persuade victims to surrender sensitive information. The lure can arrive through an email, text message, phone call, QR code, fake website or malicious application, often impersonating a bank, employer, delivery company or another trusted entity. Stolen passwords, financial details and authentication information can then be used for account takeovers, fraud, identity theft or further attacks.

The emergence of PhaaS has made this process considerably easier.


PhaaS lowers the barrier for cybercriminals

Instead of developing an operation independently, criminals can purchase packages containing fake login pages, legitimate-looking email templates, phishing-site hosting, target lists and setup instructions. Some providers also offer technical assistance and campaign-management capabilities.

The model mirrors legitimate software-as-a-service businesses, except the product is designed to facilitate cybercrime. Microsoft describes the wider cybercrime-as-a-service economy as increasingly commercialised, with specialised services allowing criminals to outsource different parts of an attack.

This creates a multiplier effect. Criminals with limited technical expertise can deploy infrastructure developed by more experienced operators, allowing phishing campaigns to reach far more people than a small group of skilled attackers could target independently.

The threat is therefore not simply that individual phishing messages are becoming more convincing. It is that the number of people capable of launching campaigns is increasing.


PhaaS is evolving beyond password theft

Modern phishing services can also target authentication sessions rather than simply collecting usernames and passwords.

Adversary-in-the-middle attacks, for example, place attacker-controlled infrastructure between a victim and the legitimate authentication service. The victim may still complete the expected login and MFA process, while the attacker attempts to capture authentication information or session tokens that can later be used to access the account.

Microsoft has documented phishing campaigns in which attackers captured tokens generated during legitimate authentication, demonstrating why stolen credentials are not the only concern.

The scale of these operations was illustrated in March 2026 when authorities disrupted Tycoon 2FA, a PhaaS platform that facilitated phishing attacks against nearly 100,000 organisations. Europol said the service generated tens of millions of phishing emails each month and, by mid-2025, accounted for roughly 62% of phishing attempts blocked by Microsoft.


AI is making familiar warning signs less reliable

Artificial intelligence is adding another advantage for attackers by making social-engineering content faster and easier to produce.

Poor grammar and spelling mistakes were once common indicators of phishing. Generative AI can now produce polished messages in seconds, allowing criminals to create more convincing communications and adapt them to different targets. Microsoft has reported that cybercriminals are using AI to automate phishing and generate synthetic content.

Users therefore need to focus less on whether a message is grammatically correct and more on what it is asking them to do.

Unexpected requests for passwords, payment information, verification codes or urgent account actions should be independently verified. Links should be inspected before opening, while sensitive websites are safer to access directly rather than through unsolicited messages. Unexpected attachments should also be treated cautiously.


Defence must account for stolen credentials

Basic security practices remain important, but organisations should also assume that phishing attempts will occasionally succeed.

Unique passwords stored in a password manager can limit the damage caused by credential reuse, while multifactor authentication adds another layer of protection. However, phishing-resistant authentication such as passkeys and FIDO-based methods provides stronger protection against attacks designed to capture authentication information.

Microsoft says phishing-resistant MFA can stop more than 99% of attacks of this type even when attackers possess the password.

Organisations should also monitor unusual account activity, remove unnecessary accounts and minimise user privileges so that compromised credentials do not automatically provide extensive access.

PhaaS has therefore changed more than the technical mechanics of phishing. It has changed who can conduct these attacks and how easily they can be scaled. As criminal infrastructure becomes increasingly commercialised and AI reduces the effort required to produce convincing lures, defending against phishing can no longer depend solely on recognising suspicious messages.

The stronger strategy is to combine user awareness with authentication and access controls designed to limit what happens when a phishing attempt succeeds.

Malware Attacks Google-Synced Passkeys

 

Security researchers have uncovered three attack techniques that could allow malware on compromised Windows computers to abuse passkeys synchronized through Google Password Manager. The attacks, collectively called “Pass-ta-key,” target Chrome devices equipped with a Trusted Platform Module (TPM). Rather than breaking the cryptography behind passkeys, the techniques exploit weaknesses in device registration, recovery, user verification, and cloud synchronization. 

Passkeys are widely considered safer than passwords because they cannot be guessed, reused, or easily stolen through phishing. They normally rely on a device-based cryptographic key and may require a PIN, fingerprint, or facial recognition to approve a login. However, Unit 42 researchers found that malware already running on a victim’s computer could manipulate Chrome’s trusted-device mechanisms without requiring administrator privileges or direct user interaction. 

The first technique, Pass-ta-key, abuses Chrome’s TPM-backed device identity key to make Google’s cloud authenticator believe that a request came from the legitimate computer. The service may then return a valid authentication assertion that attackers can use to access a protected account, even without biometric or PIN verification. This attack failed against GitHub because the platform correctly checked the WebAuthn user-verification flag, but it succeeded against eBay before the company fixed the validation issue. 

The second method, Silver Pass-ta-key, enables attackers to register their own verification key during a forced Chrome re-registration process. Malware can invalidate the existing verification state or delete local passkey-related data, allowing the attacker-controlled key to be accepted as proof that the device was unlocked by its owner. The most serious technique, Golden Pass-ta-key, attempts to extract Google Password Manager’s Security Domain Secret from Chrome’s memory. This master key encrypts synchronized passkey records, so stealing it could allow attackers to recover private keys and impersonate the victim from another device. 

Unit 42 said the stolen secret could potentially decrypt both existing and future passkeys because Google’s current implementation reportedly does not provide a method to rotate or revoke it. The findings highlight that passkeys remain resistant to phishing but cannot fully protect accounts when malware controls a trusted device or browser process. Websites should strictly validate user-verification signals, while credential managers should strengthen device enrollment, recovery, re-registration, and protection of encryption keys in memory. Google was notified of the research, although a complete public response or confirmation of remediation was not immediately available.

BTMOB Android RAT Ecosystem Expands With Resellers, Source-Code Sellers and Impersonators

 

The Android remote access trojan known as BTMOB most likely began as a centralized malware-as-a-service operation but transformed into a wider ecosystem, with resellers, source code buyers, rogue operators, and possibly even impersonators, according to the Flare researchers. BTMOB is a remote access trojan for Android devices that takes the form of malware-as-a-service.

It offers an “exploit chain,” that is, a malicious application, droppers, a payload builder, a Windows operator panel, servers, and phishing and credential-stealing tools. All of the components may be purchased in various combinations, depending on the chosen subscription plan. Some of the options include private infrastructure, customized builds, and technical support. The Flare researchers analyzed thousands of relevant forum and chat threads to document BTMOB’s activity and distribution channels. 

They tracked the malware’s progress from its first appearances in mid-2025 to the present day. In their findings, the researchers observed that while an official channel was distributing the service and its components, other purportedly independent channels and forums sold subscriptions, reseller panels, code, and even alternative versions of the malware under the same name. In particular, the official account announced the V2 of the malware for rent or sale for $700 per month, $3,000 for a lifetime subscription or $5,000 with additional monthly payments for the private infrastructure and support. Less than a month later, the same account announced technical issues and claimed that over 4,000 devices were connected to BTMOB’s servers. 

According to the researchers, the account advertised a full source code and setup instructions for BTMOB for $20,000. The package included PHP and Node.js server components, a VB.NET control panel and Java Android code. The advertised source-code price later fell to $10,000 in May 2025. Additionally, they noticed that the Spanish/Portuguese Telegram channel had an issue between two admins, one of whom left the project. The main channel then announced that from now on, all the administrators would function independently. 

It also stated that one of them, based in Brazil, had bought the source code and was running his own fork of BTMOB. After that, the secondary market appeared and started advertising much cheaper alternatives to the official subscription. In particular, one Telegram campaign announced the lifetime access to version 4.1.2 and 4.2 of BTMOB for $500 and purported RAT and server source code for $1,500. Other channels and forums also offered subscriptions, reseller panels, source code, and lifetime accounts for different prices and conditions.  

It is unclear whether the accounts offering the alternative versions of BTMOB are legitimate or not, as many of them could have used pirated materials or have been scams. For example, the official account warned all their partners that there is only one official BTMOB channel and that other accounts do not represent the company and are not affiliated with it. 

Nevertheless, the official account advertised the V4.1 release in February 2026 and V4.5 in April 2026. According to the announcement, the subscription for the private server hosting of several accounts costs about $1,200 lifetime account, a $3,000, and the source code for the server itself costs $7,000.

Coldcard Bitcoin Wallets Hit by Ongoing Attack Exploiting Key Generation Flaw


A software flaw in Coldcard hardware wallets has raised fresh concerns about the security of offline cryptocurrency storage after a software flaw in Coldcard hardware wallets allowed attackers to drain millions of dollars in Bitcoin.The attack has affected thousands of wallets using Coinkite’s Coldcard devices. 

By August 3, about 1,367 Bitcoin worth US$86 million had been stolen from more than 4,500 wallets by August 3. Cold wallets are widely considered among the most secure ways to store cryptocurrency, as they keep private keys away from internet-connected devices. The Coldcard incident shows,offline storage cannot protect funds if there is a weakness in the process by which cryptographic keys are generated. 

Predictable Seed Phrases Exposed Bitcoin Wallets

The problem centers on how Coldcard devices generated the seed phrases used to recover wallets that will be used to recover and control a Bitcoin wallet in the central issue. A flaw in Coldcard's random-number generation process could produce predictable values instead of sufficiently random keys, according to a Block's engineering team analysis. Coldcard devices included a fallback mechanism based on deterministic information, including serial numbers. 

The flaw allowed attackers to calculate vulnerable wallet keys and move the funds. The losses quickly mounted over the following days. According to initial reports, the loss amount on July 31 was approximately US$38 million, however within days, the amount had more than doubled. 

Initially, Jonathan Goodman believed all three of his wallets would not be affected after checking. However, he discovered that all three had been emptied within minutes of one another on July 29. 

Coinkite Releases Fixed Firmware

Bitcoins controlled by seed phrases generated through affected firmware may be at risk, as confirmed by Coinkite. The flaw has also renewed scrutiny of hardware wallet security, regarding the assumptions surrounding hardware wallets, Coinkite has since released fixed firmware for the affected models and release tracks. 

Although offline access eliminates many Internet-based attack routes, it does not eliminate vulnerabilities in the hardware, firmware, or cryptographic processes required to create those keys. The incident also shows that keeping a wallet offline does not remove every security risk. Despite being physically disconnected from the internet, a wallet may still be vulnerable if its cryptographic keys can be predicted or reconstructed. 

Cold Storage Does Not Eliminate Cryptocurrency Risk

The Coldcard attack comes as cryptocurrency theft continues to cause major losses across the industry. Approximately US972 million of cryptocurrency were stolen during the first half of 2026, substantially lower than the US2.3 billion stolen during the same period in 2025, according to TRM Labs. A total of 207 hacking incidents were recorded during the first six months of 2026, the highest total in the firm's history. 

A TRM Labs report indicates that infrastructure and key compromises account for approximately 15 percent of incidents, yet 76 percent of losses were caused by them. The incident highlights a basic problem with self-custody that self-custody self-custody does not eliminate the risk of losing funds. Hardware wallets can greatly reduce online threat exposure. Their security still depends on how reliably the device generates and protects private keys. 

Affected users should check whether their wallet seeds were generated with vulnerable firmware and follow Coinkite’s guidance that their wallet seeds were generated using vulnerable firmware and follow the manufacturer's remediation instructions.The Coldcard incident shows that keeping a hardware wallet offline is only one part of cryptocurrency security. The software and cryptographic processes used to generate its keys can be just as critical.

Launching a Consulting Business? It’s Time to Get Some Skin in the Game

 



Starting a consulting business can look deceptively simple. You have expertise, you know there are businesses that need it, and unlike a product company, you do not need a warehouse full of inventory before you can start selling.

But turning expertise into a functioning consulting business is another matter.

There is a point when consulting stops being an idea and becomes a business.

It is usually somewhere between sending the first proposal and realizing that knowing how to solve a client's problem is only one part of the job. The founder now has to find the right customers, decide what the work is worth, manage contracts and finances, build a reputation and keep the pipeline moving, often while delivering the work alone.

That makes the first 90 days particularly crucial.

For a new consulting firm, those months are not simply about landing the first client. They are a testing period for the entire business model. Who actually needs the service? What are they willing to pay? Which prospects are worth pursuing? How should projects be priced? And can the founder deliver the work efficiently without creating an operation that collapses as soon as demand increases?

Market research is one of the earliest safeguards. The U.S. Small Business Administration recommends examining demand, market size, competition, economic conditions and the prices customers already pay before committing to a business idea. Competitive analysis can then help a company identify where it can establish an advantage.

For consultants, that process starts with getting specific.


Know exactly what you are selling

"Consulting" is not a niche.

A prospective client needs to understand what expertise is being offered, what problem it addresses and why this particular consultant is equipped to solve it.

That is why specialization can matter so much during the early stages. A consultant who focuses on regulatory compliance for fintech companies, for example, enters the market with a much clearer proposition than one advertising a general ability to "help businesses grow."

A narrow focus also makes research easier. The founder can identify competitors, understand the language customers use to describe their problems and determine whether there is enough demand to support the business.

The goal is not to permanently lock the consultancy into one category. It is to give the market a clear reason to remember it.

The same attention should go to the business name before significant money is spent on branding. Founders should check whether the name is already being used, whether an appropriate domain is available and whether matching social-media accounts can be secured. Legal and trademark availability should also be checked in the relevant jurisdiction.

A polished identity built around a name that cannot be used is an expensive problem to discover after launch.


Your first clients may already know you

A new consultant's first sales pipeline may be much closer than expected.

Former colleagues, previous clients, mentors and professional contacts can become referral sources, particularly when they understand exactly what the new business does.

Consulting Success has reported that 60% of consultants get their first client through referrals from their existing network.

That figure should not be treated as a promise that networking will automatically produce business. It does, however, point to an important reality for new consultants: relationships can be an early commercial asset.

The first 90 days should therefore include deliberate outreach. Reconnect with former colleagues. Tell people what service you are offering. Attend relevant industry events. Join professional or business-owner groups. Speak to people who understand the market you are trying to enter.

The objective is not to turn every conversation into a sales pitch.

It is to make sure that when someone in your network encounters the problem you solve, they know who to call.

Keeping track of these relationships can help, too. A basic customer relationship management system or even a structured contact database can record conversations, potential opportunities and follow-up dates. Networking becomes considerably more useful when it is treated as an ongoing business process rather than a collection of business cards.


Pricing your expertise is harder than selling it

The first proposal can create an uncomfortable question for almost every new consultant: What should this actually cost?

There is no single answer.

Some consultants charge by the hour. Others set a fixed fee for a defined project. Retainers can provide recurring revenue for continuing advisory work, while value-based pricing attempts to connect the fee to the business outcome being created rather than the number of hours spent producing it.

Each approach carries a different risk.

Hourly pricing is relatively straightforward, particularly when the scope of a project is uncertain. Fixed-fee work gives clients greater predictability, but the consultant can lose money if the project expands beyond the assumptions used to calculate the fee. Retainers can create more predictable revenue but require a clear understanding of what ongoing access or services the client is actually receiving.

Value-based pricing can potentially capture more of the economic value created for a client, but it is harder to establish when a new consultancy has limited evidence of its results.

The important thing is not to choose a pricing model simply because another consulting firm uses it.

New founders should track how much time projects actually consume, including meetings, revisions, administration and unpaid communication. They should also account for software, professional services, taxes and other operating expenses.

The SBA recommends calculating startup costs and using break-even analysis to understand how pricing, costs and sales volume interact.

That turns pricing from a guess into a business calculation.

And the model does not have to remain fixed. As a consultancy gains experience, it can adjust its pricing based on the type of work clients value most and the economics of delivering it.


Not every potential client is a real prospect

A large prospect list can look impressive while contributing very little to revenue.

Consultants need to distinguish between companies that could theoretically benefit from their expertise and companies that are actually positioned to buy it.

That means asking whether the organization has the problem, whether the problem is urgent, whether it has a budget, who makes the purchasing decision and whether the consultant has a credible route into the organization.

Financial and business research can make that process more informed.

For U.S. public companies, the SEC's EDGAR system provides access to company filings that can reveal information about financial performance, operations, risks and other corporate developments.

Private companies require different sources of information, including company websites, industry publications, professional networks and available business databases.

The objective is not to conduct an exhaustive investigation of every lead. It is to avoid spending valuable time chasing prospects that are unlikely to become paying clients.

For a solo consultant, that distinction can directly affect revenue. Time spent pursuing an unsuitable prospect is time that cannot be spent delivering client work, improving an offer or finding a better-qualified lead.


The tools behind the expertise matter too

Consulting is often presented as a knowledge business, but much of the actual work happens inside ordinary productivity software.

Spreadsheets, presentations, project-management platforms, customer relationship systems and document-management tools can become part of a consultant's daily workflow.

Management Consulted COO Namaan Mian has said consultants can spend around 80% of their day working in Excel and PowerPoint.

The exact proportion will vary considerably between consulting disciplines, but the underlying lesson is useful. A consultant who is excellent at strategy but inefficient at turning analysis into a financial model, presentation or client deliverable can lose considerable time.

Technology also introduces a responsibility that is easy for new consultants to overlook.

Clients may hand an independent consultant confidential business strategies, financial records, employee information, intellectual property or customer data. Secure authentication, controlled access, encrypted storage where appropriate, reliable backups and careful file-sharing practices therefore belong in the business plan from the beginning.

For a technology or cybersecurity consultant, that expectation is even higher. The consultant's own security practices become part of their credibility.


Do not try to be the lawyer and accountant too

Running a consultancy independently does not mean every business function needs to stay with the founder.

Legal and accounting professionals can help establish the structures that allow the consultant to concentrate on client work.

The right business structure can affect taxation, paperwork and personal liability, while contracts can determine how payment, confidentiality, intellectual property and responsibilities are handled between the consultant and client. The SBA recommends considering these structural questions when setting up a business and notes that professional advisers can help with the process.

An accountant can also help establish bookkeeping practices and make sure income and expenses are being tracked properly.

These advisers do not necessarily need to be permanent employees. For a small consultancy, external professionals can often provide support when specific legal or financial questions arise.

What matters is establishing those relationships before a problem forces the issue.


Build accountability into the business

There is one final problem unique to many solo consultants: nobody else is waiting for the work to get done.

The founder may have promised to follow up with prospects, update the website, send invoices, improve a presentation, review finances and develop a new service. Then a client deadline arrives and everything else moves down the list.

An accountability partner can provide a simple counterweight.

That person could be a former colleague, mentor, fellow entrepreneur or another professional encountered through an industry association or business group. A short weekly conversation can be enough to review what was completed, what was missed and what needs to happen next.

The point is not necessarily to find another person who has all the answers.

It is to create a system in which the founder has to answer to someone besides themselves.


The first 90 days are where the business gets tested

A new consultancy does not become sustainable simply because its founder is good at what they do.

Expertise gets the business into the room. Everything else determines whether it can stay there.

The first three months should therefore be used to test the market, sharpen the niche, build relationships, qualify prospects, experiment with pricing and establish the systems needed to deliver work consistently.

That includes the less glamorous work: checking the business name, setting up financial records, understanding legal obligations, learning the software that will be used every day and protecting client information.

The U.S. Small Business Administration describes a business plan as a roadmap for structuring, operating and growing a company, while its startup-cost guidance encourages founders to understand expenses and break-even points before making financial decisions.

For a consultant, the first 90 days can serve the same purpose in practice.

By the end of them, the founder should have more than a website and a client list. They should have evidence about which customers are worth pursuing, which services generate demand, what those services cost to deliver and what the business needs to operate without constantly running on improvisation.

That is the real moment when a consultant gets skin in the game.

The expertise may have been there for years.

Now there is a business behind it.

Bitcoin Could Face Quantum Computing Threat Within Years, Experts Warn

 

Bitcoin faces existential threat from quantum computers, according to some experts. With the passage of time, researchers have voiced growing concerns that hackers could utilize these powerful processors to decrypt the cryptographic functions that protect Bitcoin. David McAlvany, the CEO of gold app Vaulted, believes that Bitcoin could be gone in four years because of quantum computing. 

However, he also noted that no such computer exists, and the timeline could be as short as two months or as long as five years. This concern revolves around the fact that some Bitcoin addresses have already been exposed on the blockchain. Galaxy Digital research published in March 2026 suggests that 7,000,000 Bitcoin, valued at around $470 billion, are located in addresses with public keys exposed on-chain. 

Meanwhile, Glassnode estimates this amount at 6,040,000 Bitcoin, or 30.2% of the crypto asset’s supply. It should be noted that these are merely estimates, not actual figures stated by the protocol. Galaxy Digital downplays the risk, noting that it is real but not existential. Exposure in this case means that the Bitcoin private keys were not actually stolen, but rather their owners have made them publicly available. The danger arises if a quantum computer manages to find a way to decrypt these private keys using the exposed public keys. 

Quantum computers’ rise and their impact on security have caused many to reconsider the threat they pose to Bitcoin. Google researcher Craig Gidney predicted in May 2025 that it would take fewer than one million qubits to decrypt RSA-2048. A Google team’s white paper that appeared in April 2026 suggested that about 500,000 qubits would be needed to decrypt Bitcoin’s elliptic-curve cryptography. Ethereum Foundation researcher Justin Drake has estimated the probability of a quantum computer extracting a Bitcoin key from an exposed public key to be 10% by 2032. 

Bitcoin developers are working on solutions to this problem. BIP-360 suggests that a new quantum-resistant address type be created, while BIP-361 calls for a two-step deprecation of legacy signatures. The process under BIP-361 would see Bitcoin that fail to adopt new cryptographic standards become unspendable, including the estimated 2.28 million BTC belonging to Satoshi Nakamoto. American Fortress has raised $8 million and is working on a standard that would give blockchain-based assets quantum resistance. 

The company’s technical paper is not yet published, and its design has not been publicly audited. In general, the debate illustrates the potential implications of the race between Bitcoin and quantum computing, as well as the ability of other blockchains to adapt in time. Although the infrastructure needed to steal these encrypted keys does not yet exist, researchers and developers are nonetheless thinking about ways to protect exposed assets.

Featured