Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Company Accused of Making $60 Million by Exploiting Sextortion Victims

A US-based digital forensics company is facing allegations that it collected at least $60 million from people seeking help with sextortion t...

All the recent news you need to know
Workplace Surveillance
AI Security Confidential Data Protection Corporate Espionage Cyber Crime Hidden Recording Device Insider Threat OpenAI Employee Arrest OpenAI Security Incident Workplace Surveillance

OpenAI Employee Arrested Over Hidden Recorder Allegations


In connection with the arrest and prosecution of an employee of OpenAI, it has been claimed that a recording device was allegedly placed in an executive conference room at the company's San Francisco headquarters. This device was reportedly intended to record confidential discussions regarding the company's artificial intelligence research and strategic plans. 

As a result of the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national, on October 9, 2026, his position has been terminated. A federal charge has been filed against him by the U.S. Department of Justice (DoJ) for using or attempting to use an electronic or mechanical device to intercept oral communications. He joined OpenAI in July 2025 and worked on its product team. 

In the executive conference room, OpenAI personnel discovered a hidden audio recording device connected to a USB port behind a television on September 30, causing an alarm to sound. During the period of September 28 to December 31, the device was installed and wrapped in toilet paper to conceal it, according to the complaint.

The room was regularly used to hold executive meetings related to highly confidential technical, commercial, and strategic matters. This information included proprietary research, product development plans, business opportunities, government engagements, and information concerning the company's artificial intelligence progress. The investigation also included review of office surveillance footage that showed Alfozan near the conference room several times before the device was discovered.

According to the complaint, he did not play any part in the meetings in which the device was discovered. As a result of the investigation, the investigation has also allege that later he returned to the room and observed the recording device behind the television. Furthermore, Alfozan is accused of using a workplace productivity tool to gather information about OpenAI's offices, conference rooms, meeting schedules, and room capacity before the device was installed, according to the FBI complaint. 

The searches reportedly included information about leadership meetings as well as sessions involving external partners, raising questions regarding potential attempts to identify opportunities for recording confidential conversations. As part of the investigation, investigators examined prompts submitted via an account associated with Alfozan's spouse's chatbot.

According to the account, between September 24 and 30, it was allegedly used to obtain information about building and configuring audio recorders, setting up Wi-Fi, enabling live audio monitoring, encrypting stored data, and remote access to the device. According to the complaint, the chatbot account shares identifiers and other attributes with Alfozan's own account. 

A second recording device was allegedly discovered on October 5, when OpenAI's security personnel inspected an unattended bag left in another room of the company's building. Among the items in the bag are Alfozan's wallet and identification as well as a device similar to that found in the executive conference room. 

A surveillance video was also allegedly captured by investigators capturing him checking behind the television, where the first device had been placed. OpenAI reported that the recording device had encryption capabilities, audio monitoring capabilities, and an encrypted data transfer mechanism for avoiding detection. 

Following the analysis of the device by internal AI models and the identification of the employee who allegedly perpetrated it, the company referred the case to the FBI. Even though the allegations were somewhat serious, OpenAI stated that there was no evidence that Alfozan improperly accessed or removed model weights, source code, or customer data. Security measures provided by the company were intended to address threats ranging from insider threats to cybercriminals and nation-state actors. 

As a result of his arrest, Alfozan appeared in federal court and is facing the possibility of five years in prison, a $250,000 fine, and a three-year probation period. Unauthorized recording of confidential technical developments and business strategies can expose confidential information even without direct access to the digital systems, as outlined in the investigation of the risks posed by insider threats at organizations engaged in sensitive AI research. 

Those organizations developing advanced artificial intelligence technologies should take precautions against insider threats, maintain workplace security controls, and protect confidential information. This case is currently being investigated, and the allegations have not yet been proven in court.
Read more »
XWorm RAT
Browser Session Hijacking cyber espionage Cyber Security Threats Endpoint security malware Remote Access Trojan Surveillance Malware Webcam Spying XWorm RAT

XWorm RAT Evolves Into Advanced Surveillance Malware

Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions. 

It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions. According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025. 

The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices. 

A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis. 

There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil. HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords.

Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser. By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance. 

Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation. Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions. 

Continued Development Raises Security Concerns 

As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication. 

By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives. NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone. 

An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed. It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications. 

Network segmentation will also allow you to limit the spread of malware across other connected systems. Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.

Read more »
Xandr
Advertising Data Regulation European Union GDPR Grindr Microsoft Norway Privacy sensitive data Xandr

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers

 



Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve.

Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process.

Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision.

The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed.

In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019.

A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board.

The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation.

Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings.

The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.




Read more »
TFG
Customer Data Cyber Attacks Fashion Retail IT Systems TFG

Hobbs and Whistles Owner Hit by Cyberattack

 

The owner of Hobbs, Phase Eight, and Whistles has become the latest major fashion retailer to be hit by a cyberattack. The Foschini Group (TFG) confirmed that its UK business, TFG London, discovered the incident on October 11, leaving several IT systems offline and disrupting customer orders across the three brands. 

Although physical stores remain open, the company said some website functions may be unavailable while its investigation continues. Customers have been warned that orders placed on or after Sunday could be delayed, and TFG has apologized for the disruption while promising further updates as appropriate. 

TFG says it activated its incident-response and business-continuity plans immediately, brought in external cybersecurity specialists, and notified UK authorities. The Information Commissioner’s Office confirmed it has received a breach report from TFG Brands (London) Limited and is assessing the information provided. 

There is some reassurance for shoppers: TFG London said payment processing is handled by a third party and that, based on its investigation so far, it has no reason to believe payment information is at risk. However, the company is still determining whether other personal or sensitive customer data has been compromised and says it will notify affected individuals or organizations if evidence of a breach emerges.

The company has not yet explained how attackers gained access, whether ransomware was involved, or when systems will be fully restored. TFG added that its White Stuff and Inside Story businesses, along with its African and Australian operations, are unaffected because they run on separate IT systems. 

The attack follows a difficult stretch for fashion retail. Last week, ASOS disclosed that an attacker impersonated a trusted contact to obtain an employee’s login credentials and access third-party platforms containing customer names and contact details. H&M is also reportedly investigating claims involving the ShinyHunters group, though it says it has found no indication that its systems were compromised. 

No evidence currently connects the TFG London, ASOS, and H&M incidents, and H&M has not confirmed a breach. Still, three prominent fashion businesses facing cyber trouble in just over a week suggests that retailers remain highly attractive targets for criminals seeking customer data, operational disruption, or leverage. For TFG, the immediate priority is restoring services and establishing the scope of the incident. For customers, the case is a reminder that even when payment details appear safe, retailers may hold substantial personal information whose exposure can take days or weeks to fully assess.
Read more »
Cyber Security
AI Model AI Security AI technology Anthropic AI Anthropic AI security Cyber Security

Anthropic Warns AI Worms Could Soon Spread Across IoT Devices

 

Small artificial intelligence models could soon be able to freely replicate across internet devices, forming botnets that do not require centralized computers to control them, according to an Anthropic Frontier Red Team paper. The paper’s authors explored if foundation models could be run on unknown cheap devices and execute the actions required to replicate across other interconnected devices. Anthropic bought 15 cheap Android TV boxes for $55 each to see how large an open-weight model could be before it could no longer be hosted on such devices. 

The team found that a model with 26 billion parameters could generate 0.39 tokens per second. They also found that a 9 billion parameter model could run on 8 out of 9 of the different hardware types they tried. The team then tried to see if a model could replicate across 8 emulated Android devices attached to a network. To make matters easier for the would-be-attackers, the researchers made the hacking process trivial; they only had to focus on the artificial intelligence processes. 

Only the GLM-5.2 among the open-weight models was able to fully complete the replication process, doing so on four out of five tries, and managed to infect all 8 devices on the network. Anthropic warned that the experiments should not be considered an accurate representation of how such an attack might unfold in the real world, but the results nevertheless show that attacks are becoming increasingly likely as models grow more capable. 

Models with over 30 billion parameters do not have the ability to fully perform all actions required to replicate, but they can manage single aspects of the process. If development proceeds at its historical rate, then models will be able to achieve the capability demonstrated by GLM-5.2 by 2026. Self-replicating AI models could follow soon after. The researchers also estimated the scale of such an attack. 

If there was a Kimwolf-class botnet that had already successfully infected over 2 million devices, using up all 15 of the TV boxes mentioned earlier would result in 133000 instances of the 26-billion-parameter model being created. This would amount to a combined performance of up to 40 Nvidia H100 GPUs, but it would take more than a day for all instances to be created. Such an attack surface is hard to prevent because there are no singular points of failure, but even if such a worm managed to successfully infect a network of devices, it would still be very visible to most network infrastructure. 

Large traffic volumes and unusual communications patterns between devices that would otherwise not communicate with each other will raise flags with most internet service providers. Anthropic also found that manufacturers could reduce the threat surface by replacing default passwords with more complex ones. Many previous botnets, including the infamous Mirai malware, were nearly impossible to stop because many IoT devices had default passwords that were too simple to guess. 

Anthropic warned that while a fully autonomous worm was not yet available, a continuing increase in model size and capability, along with the growing ability of models to apply knowledge between different model classes, will severely limit the time defenders have to fix vulnerabilities in Internet of Things devices.
Read more »
Technology
LG Root Access Security Flaws Smart TV Technology

Critical Flaws in LG Smart TVs Could Allow Hackers to Gain Root Access Over Local Networks


Three security vulnerabilities in LG's webOS operating system could allow attackers to gain complete control of certain LG smart TVs without authentication or any action from the owner. The flaws can be combined to obtain root access when an attacker is connected to the same local network as the television.

LG has released a firmware fix for the vulnerabilities, following their disclosure by SSD Secure Disclosure on October 12. Users are advised to check their devices for available software updates.

Models impacted

Researchers tested the vulnerability chain on two LG television models: the 32LQ636BPSA and the 27TQ600SW. Both devices were running webOS version 7.5.7-25 with firmware 04.54.40. It remains unclear whether other models or firmware versions are affected.

The attack begins by targeting a network service on port 3001, which is used by the LG ThinQ application to pair with televisions. Researchers found that an attacker could exploit a built-in application called sync-demo to bypass the normal pairing PIN requirement and obtain a privileged key.

Using this key, the attacker can launch another preinstalled application, known as cmp-client, and direct it to a webpage controlled by the attacker. The application does not properly restrict where it can navigate, allowing the malicious webpage to access an internal webOS interface called PalmServiceBridge.

This interface provides communication with system services. Researchers found that it could be used to reach pmlogd, a system logging service that operates with root privileges. Because the service does not properly validate certain input, an attacker can inject shell commands that are executed with the highest level of access on the television.

The combined vulnerabilities therefore allow an attacker to move from an unauthenticated network connection to root-level control without requiring the television owner to enter a PIN, approve a request or click a link.

What is at risk?

Root access can give attackers extensive control over an affected television. Depending on the device configuration and the attacker's actions, this could enable unauthorised software execution, system manipulation and potential exposure of information stored on the device.

The disclosure was demonstrated by an anonymous researcher who secured third place in the LG webOS category at the TyphoonPWN 2026 security competition in Seoul. No CVE identifiers have been assigned to these newly disclosed flaws, and no exploitation in the wild has been reported.

Read more »
Subscribe to: Posts (Atom)

Featured