Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Privacy
Age Verification AI Fraud Prevention biometric privacy Digital Identity Verification Facial Age Estimation On-Device Age Verification Privacy

The Future of Age Verification Shifts to On-Device Privacy

 


It has become increasingly common for governments around the world to tighten online age verification requirements, as well as to incorporate a new approach to digital identity verification, which keeps facial data on the user's device rather than sending it to an external server. 

In addition to the United Kingdom, Australia, Brazil, and several US states introducing stricter rules to protect minors online, more than 30 age assurance laws are now in effect worldwide. There has been a growing concern about the gathering and storage of biometric information as platforms race to comply with regulations. 

Major technology companies have also explored alternative means of verifying the age of users in order to protect privacy. As opposed to requiring users to upload government-issued identification or selfies, newer systems are increasingly designed to collect only the essential information such as confirming that a user is part of a particular age group helping platforms comply with legal requirements while limiting the amount of personal information they collect. 

A facial age estimation system traditionally captures a user's face, uploads the image to a cloud server, and is then processed remotely. This model has been effective, however it raises significant privacy and cybersecurity concerns, particularly as biometrics become increasingly valuable targets for cybercriminals. 

As reported by the Identity Theft Resource Center's 2025 Annual Data Breach Report, 3,322 data breaches were reported in the United States in 2025, an increase of 79% compared to the previous five years. There was also a significant concern among consumers regarding how their biometric data is collected and utilized by 63% of respondents.

Identity verification company Incode has launched an on-device age estimation system to address these concerns. Under this approach, facial images are not sent to remote servers or stored after verification, but are only processed on smartphone, tablet, or laptop devices. Only the verification result-that is, whether the user complies with the required age threshold-is shared with the requesting platform. These approaches follow the principle of data minimization, where systems only collect the information necessary to carry out a specific task. 

A developer can offer age-appropriate services while limiting the exposure of sensitive personal data by confirming the eligibility of users instead of storing facial images or identity documents. Additionally, the system incorporates passive liveness detection in order to verify the presence of a real person, which prevents fraud associated with photographs, replayed videos, or artificial intelligence-generated deepfakes. 

If the age check cannot be completed successfully, users are automatically offered an alternative verification method. While facial data remains on the user's device, limited session metadata, such as device and connection characteristics, is analyzed on the server to detect tampering, injected camera feeds, and other sophisticated fraud attempts.

The company states that this information does not include biometric data and is used solely to maintain session integrity. It is nonetheless important to note that, despite these improvements, there is no foolproof age verification system. Determined users may attempt to overcome restrictions, but developers must adhere to applicable privacy regulations and implement verification technologies correctly. Generally speaking, it remains difficult to strike a balance between safeguarding children online, maintaining user privacy, and preventing unauthorized access. 

AI-powered identity fraud has become a growing concern, resulting in the shift. Incode reports that in 2024, AI-aided fraud represented only 3% of fraud attempts, but by 2026, it had increased to 40%. The company believes that figure will exceed 90% in the next 18 months. 

Besides launching its on-device authentication technology, Incode recently announced an investment of $100 million in privacy-protecting identity infrastructure and the acquisition of Identiq, a company focused on privacy.  As a result of this initiative, fraud prevention is enhanced while sensitive user information is reduced through the elimination of the need for central collection or storage. 

There is continued debate among policymakers worldwide about the operation of age assurance systems, with privacy advocates arguing that online platforms should collect as little personal information as possible. It is a reflection of an industry-wide initiative to comply with evolving regulations while reducing the risks associated with storing biometric information by switching to on-device processing and limited data sharing. 

The adoption of digital age verification has become a legal requirement across a growing number of jurisdictions. Privacy-first technologies that minimize the exposure of biometric data may increasingly influence compliance standards in the future.

Governments are increasing age verification requirements, and privacy-preserving technologies are transforming the verification of digital identity. A pivotal role in the future of online safety will be played by solutions that minimize the collection of biometric information while maintaining security and regulatory compliance.
Read more »
Technology
Blockchain cryptocurrency Financial markets Polymarket Technology

What Is Polymarket? How Blockchain Is Transforming Prediction Markets

 



Prediction markets have existed for decades as a way to forecast future events, but blockchain technology has reshaped how they operate. Among the platforms driving this evolution is Polymarket, a decentralized prediction market launched in 2020 that enables users to trade on the outcomes of real-world events using blockchain technology rather than relying on a traditional bookmaker.

Unlike conventional betting platforms, Polymarket functions as a peer-to-peer marketplace where participants buy and sell shares tied to the outcome of an event. Instead of placing wagers against a central operator, users trade with one another, while blockchain infrastructure records every transaction transparently. Built on the Polygon network, the platform allows users to retain self-custody of their assets through compatible cryptocurrency wallets, with trading collateral managed on-chain.

Markets on Polymarket span a wide range of topics, including elections, major sporting events, cryptocurrency and financial markets, macroeconomic indicators, legislation, entertainment awards, weather events, and other headline-driven developments. The platform's appeal lies in its ability to convert collective opinion into real-time market prices that reflect how participants assess the probability of future outcomes. As breaking news emerges, market prices adjust almost instantly, offering a continuously updated snapshot of public expectations.

Trading is designed to be relatively straightforward. After connecting a supported crypto wallet and funding an account, users can browse active markets with clearly defined settlement rules and expiration dates. Participants purchase either "Yes" or "No" shares, typically priced between $0.01 and $1.00, with the price broadly representing the market's implied probability of an event occurring. For example, a "Yes" share priced at $0.42 suggests traders collectively estimate roughly a 42% chance that the event will happen. If the prediction proves correct when the market resolves, each winning share settles at $1, while incorrect positions become worthless. Unlike traditional wagers, positions can also be bought or sold before settlement, allowing traders to realize gains or reduce losses as market sentiment changes.

A key differentiator is the platform's decentralized settlement process. Rather than relying solely on a central operator, market outcomes are verified through oracle systems that provide trusted real-world data to smart contracts, which then automate payouts to eligible participants. Combined with Polygon's comparatively low transaction fees and faster confirmation times, this infrastructure enables transparent trading and efficient settlement while reducing reliance on intermediaries.

Polymarket has gained popularity among cryptocurrency enthusiasts, analysts, journalists, and researchers because it offers a real-time measure of market sentiment across thousands of topics. Many users participate to express informed opinions, hedge against uncertainty, or monitor how collective expectations evolve around elections, economic releases, technology developments, sports competitions, and global news.

However, participation is not without risk. Like any speculative market, users can lose their entire investment if their prediction is incorrect. Less active markets may also experience low liquidity, making it difficult to enter or exit positions efficiently, while thin trading volumes can amplify price swings following large trades or rumors. Participants should also consider smart contract risks, dependence on oracle systems for accurate settlement, and the possibility of delayed resolutions if disputes arise over market outcomes.

Regulation remains one of the most daunting challenges for decentralized prediction markets. Availability varies across jurisdictions, with some countries permitting access while others impose restrictions or outright bans. As regulatory frameworks continue to evolve, users should review the laws applicable in their region before participating. Recent years have also seen Polymarket navigate changing regulatory requirements while expanding its operations in new markets.

Beyond speculation, prediction markets have long attracted interest from economists because they aggregate information from large groups of participants. Academic research suggests that highly liquid prediction markets can, in certain circumstances, rival or outperform traditional polling and expert forecasts by rapidly incorporating new information into prices. Nevertheless, forecasting accuracy depends heavily on market participation and liquidity, meaning smaller or thinly traded markets may not always reflect the true probability of an event.

As blockchain infrastructure, oracle technology, and regulatory clarity continue to mature, decentralized prediction markets are expected to play an increasingly important role in forecasting global events. Platforms such as Polymarket are demonstrating how transparent, blockchain-based markets can provide not only a new way to trade on future outcomes but also a powerful tool for understanding collective expectations in an increasingly data-driven world.

Read more »
Cybersecurity measures
AI cybersecurity AI Powered Cyber Attacks AI technology AI Threat Bank Security cyber resilience Cyber Security Cybersecurity measures

Indian Banks Increase Cybersecurity Investments to Counter AI-Powered Cyber Threats

 

Indian banks are ramping up cybersecurity spending as artificial intelligence-fueled cyber threats grow more sophisticated. As per the Digital Threat Report 2025-26 for the Banking, Financial Services and Insurance (BFSI) sector, six out of seven cyber threats identified by the report in the previous year have become operational, forcing banks to shore up their cyber defenses. 

“The threat landscape is evolving with bad actors using AI, impersonation, and payment process orchestration to mimic legitimate customer behavior. BFSI players are adopting advanced security technologies and countermeasures such as AI-driven fraud detection and prevention, zero-trust architecture, micro segmentation, and enhanced cyber defenses,” said the report. 

With security being increasingly prioritized as an operating imperative over technology spending, banks are also investing more in secure digital lending platforms, Unified Payment Interface (UPI) services, cloud, and AI applications. 

PNB, for instance, has set aside about 20% of its FY27 technology budget or ₹7-8 billion for cybersecurity. This is more than double the spending made in the previous fiscal. “We can always increase our cybersecurity budget if the need arises,” said the bank. The Reserve Bank of India (RBI) has also been focusing on cybersecurity and AI governance. 

In the recent past, the central bank has been interacting with banks on AI, geopolitical issues, and ECL (expected credit loss) implementation. Additionally, RBI has also shared a draft framework on AI governance for regulated entities. “The BFSI cybersecurity market size is estimated to grow at a double-digit CAGR through 2030 as banks and financial institutions continue to focus on operational resilience, address technology-related third-party risks, respond to tightening regulatory compliance needs, and mitigate the talent shortage in specialized cybersecurity roles,” said the report. 

While BFSI players are witnessing a dip in capital expenditures (capex) on physical infrastructure, technology budgets are being allocated to cyber monitoring, identity management, fraud management systems, cloud security, and regular vulnerability assessments. “The Financial Stability Report (FSR) 2025 has identified AI-enabled cyber threats as one of the critical emerging risks to the financial stability of the Indian economy. 

Even as India’s banking system remains resilient with stress tests showing that gross NPAs will remain below 2% through 2028 in the baseline scenario, the focus on cybersecurity, particularly AI-driven financial crime prevention, is gaining momentum,” said the report. “With AI-driven financial crime prevention becoming a strategic imperative, cybersecurity is set to be one of the largest technology expenditures for banks. 

The question now is not whether banks will increase cybersecurity spending but how quickly they can build resilient and AI-ready digital ecosystems to secure their digital banking ecosystems,” added the report.
Read more »
Wearable Tech
Cyber Security data security Fitness Trackers Health Privacy Wearable Tech

Fitness Trackers Can Expose Your Health Data, EFF Warns

 

Fitness trackers have become part of everyday life, helping people monitor steps, sleep, heart rate, stress, and workouts with impressive convenience. But a recent investigation highlighted a serious privacy issue: much of the health data collected by popular wearables is not protected under federal health privacy law, which means it can be exposed through legal requests far more easily than many users realize. 

Among the major brands reviewed, Apple stands out because its health data can be protected with end-to-end encryption, giving users a stronger layer of control over sensitive information. The core concern is that most wearable devices rely on cloud storage, where the company that makes the device often holds the keys to the data. That setup may feel secure because the information is encrypted while being transferred and stored, but it is not the same as true end-to-end encryption. If the company can access the data, then law enforcement may also be able to obtain it through a subpoena. 

For users, that means intimate details such as sleep patterns, location history, menstrual cycles, and heart-rate trends may be accessible outside the privacy protections many people assume apply.  This issue matters because wearable health data is highly revealing. A fitness tracker can create a detailed picture of daily routines, physical condition, and even emotional stress patterns. In legal disputes, such records have already been used to challenge alibis, verify movements, and support claims in civil cases. 

As wearable adoption continues to grow, the volume of personal information collected will only increase, making privacy protections more important than ever. Many consumers buy these products for wellness, but they may not realize they are also generating a persistent data trail. Apple’s approach is different because its Health ecosystem supports end-to-end encryption when properly configured. 

That means the company cannot read the protected health data, and a subpoena would not produce the same level of information that cloud-based systems can reveal. Apple also allows users to limit syncing and keep more data local, which adds another privacy advantage. For users who want the strongest protection, this makes Apple Watch and Apple Health a standout option compared with most other wearable brands. 

Before buying a fitness tracker, consumers should look beyond features like battery life, workout tracking, and smartwatch functions. Privacy policies, transparency reports, local storage options, and encryption standards should matter just as much as design and price. In an era where health data is constantly collected, the best wearable is not only the one that tracks well, but the one that protects personal information responsibly.
Read more »
Vehicle Software Updates
Automotive Cybersecurity Connected Car Security Connected Vehicles OTA Security Over-The-Air Updates Technology Transportation Cybersecurity Vehicle Software Updates

Over-the-Air Vehicle Updates Raise Cybersecurity and National Security Concerns


 

Modern vehicles are being transformed by the adoption of over-the-air (OTA) technology. However, cybersecurity experts warn that the same technology can also expose connected vehicles to more sophisticated cyber threats as time passes. 

By using OTA technology, automakers are able to update software, update security patches, update firmware, and introduce new features remotely, without the need for vehicles to visit service centers. After being first introduced by Tesla in 2012, this technology has become a standard feature across the automotive industry as a result of its convenience and cost effectiveness.

Modern vehicles have evolved into software-defined platforms that are interconnected with smartphones, cloud services, charging infrastructure, and, in some cases, other vehicles, as well as smartphones. 

With OTA, in addition to software updates and remote diagnostics, connected services, artificial intelligence-powered voice assistants, and feature enhancements, cybersecurity is becoming a more critical component of vehicle safety. However, analysts caution that growing connectivity can also increase the vulnerability of cybercriminals and nation-state actors to attack. 

A successful compromise of OTA systems can result in attackers affecting vehicle functions, stealing sensitive information, or exploiting weaknesses in transportation infrastructure, according to experts. According to Professor Shaikh, OTA updates have greatly reduced the need for recalls and routine service of vehicles, thereby improving vehicle maintenance. It is imperative to strengthen security measures, despite these operational benefits, as the reliance on connected systems continues to grow. Security concerns go beyond data privacy, according to cybersecurity analysts. 

Access to vehicle control systems by an unauthorised individual could pose a broader national security risk, especially if foreign adversaries exploit vulnerabilities in connected transportation systems. As part of a recent report authored by the American Enterprise Institute, the Institute recommended strengthening protections for the automotive sector by conducting additional security reviews, restricting foreign hardware and software, and improving transparency around the collection of vehicle data. 

A draft amendment to the Central Motor Vehicles Rules in India proposes mandatory cybersecurity and software update management requirements for certain vehicle categories, as part of its efforts to strengthen regulatory oversight. Before connected vehicles can be sold, manufacturers would be required to implement certified cybersecurity management systems and secure software update processes.

During real-world testing, Norwegian public transport operator Ruter discovered that one of its buses could theoretically be remotely disabled by utilizing its mobile-connected control system. Several transportation authorities in the United Kingdom and Denmark conducted investigations into potential vulnerabilities associated with connected vehicles in response to these findings. Automakers are not the only entity responsible for securing connected vehicles, according to industry experts. 

A vehicle's cybersecurity is also affected by vulnerabilities anywhere within its supply chain, including software developers, component suppliers, semiconductor manufacturers, telematics providers, and other technology partners. As OTA technology is being utilized in buses, rail networks, maritime transportation, drones, industrial machinery, and robotics, experts emphasize that this issue is not limited to a single manufacturer or country. 

In addition, cybersecurity experts emphasize the need for a lifecycle approach rather than a one-time compliance approach to safeguard connected vehicles, which has become a more widespread challenge across critical infrastructure sectors. In order to improve vehicle safety, it becomes increasingly important to develop secure software, authenticate OTA updates, monitor threats continuously, and respond to vulnerabilities quickly, just as it is important to maintain traditional mechanical safety measures. 

Governments, automakers, and technology providers must work together to strengthen authentication, encryption, software verification, and continuous monitoring of OTA platforms, according to cybersecurity specialists. Ensure the security of remote software updates in the era of connected mobility in order to protect both consumers and national transportation systems as the industry standard becomes more prevalent.
Read more »
Supply Chain Attacks
Amazon malware Sapphire Sleet software Supply Chain Attacks

Amazon Attributes Earlier npm Supply Chain Attacks to North Korea's Sapphire Sleet

 



Amazon has linked a series of high-profile npm supply chain compromises spanning 2025 and 2026 to the North Korean threat group Sapphire Sleet, suggesting that attacks initially viewed as isolated incidents may instead represent a coordinated campaign targeting widely trusted open source software.

In a threat intelligence report published on July 29, Amazon assessed with medium confidence that the same actor responsible for the March 2026 compromise of the popular JavaScript package axios was also behind earlier attacks involving the npm packages debug and chalk, as well as a lesser-known package called typo-crypto. The assessment expands the scope of what security researchers now believe to be a sustained operation aimed at infiltrating software supply chains through compromised maintainer accounts.

The September 2025 incident involving debug and chalk drew widespread attention after attackers successfully phished an npm maintainer using a fraudulent npm website designed to harvest credentials. Once access was obtained, malicious updates were published to multiple packages collectively downloaded billions of times each week. Rather than infecting developers' systems directly, the malicious code targeted cryptocurrency users by intercepting browser-based wallet activity and replacing legitimate transaction addresses before users approved transfers.

At the time, security firms including Aikido Security and Wiz documented the compromise and analyzed its technical behavior, but neither publicly attributed the operation to a specific threat actor. Amazon's latest research represents the first detailed effort to connect that incident with a broader campaign linked to North Korea.

According to Amazon, investigators uncovered additional evidence while examining the March 2026 axios compromise. During that investigation, analysts identified a domain registered in 2025 that ultimately led them to a previously overlooked npm package named typo-crypto. Although the package attracted relatively few downloads, Amazon believes it served as an early testing ground for techniques that later appeared in attacks targeting far more widely used libraries.

The company argues that the campaigns share several operational characteristics, including the deployment of trojanized packages, overlapping command-and-control infrastructure, similarities in malicious code, and the use of social engineering to gain access to trusted maintainer accounts before distributing compromised package updates. Based on those shared indicators, Amazon believes the incidents form part of the same long-running operation.

However, the report has also prompted discussion within the security community regarding the strength of the evidence supporting the attribution. While Amazon outlines common tactics and infrastructure across the campaigns, the report does not publicly specify which individual indicators directly connect each incident. As a result, some researchers have noted that although the overall assessment appears plausible, additional technical evidence would help strengthen the case for linking every campaign to the same actor.

The technical methods employed across the attacks also differed substantially.

The malicious code inserted into debug and chalk functioned primarily within web browsers. It intercepted browser APIs associated with cryptocurrency wallets and modified transaction destinations before users authorized transfers. Security researchers observed that the attack did not rely on npm lifecycle scripts or establish persistent malware on infected systems.

By contrast, the March 2026 axios compromise involved a post-install payload that executed during package installation, allowing attackers to deploy additional malicious components. Amazon also identified similarities between that campaign and the earlier typo-crypto package, which contained a disguised file named core.js. The file reportedly activated only after receiving a specific trigger and then retrieved an operating system-specific second-stage payload from a remote command-and-control server.

Amazon identified infrastructure associated with the malicious package, including the domain npmjs.store and the IP address 216.74.123.126. The company also noted that the malware concealed portions of its functionality using Base64 encoding combined with an XOR-based obfuscation routine.

Further examination of the npm registry revealed additional irregularities surrounding typo-crypto. The package appeared to have been published only once, with no earlier legitimate versions preceding the malicious release. Its metadata closely resembled that of the legitimate crypto-js project, including copied descriptions and keywords, while advertising a version number ahead of crypto-js itself. Those characteristics suggest the package was created from the outset to impersonate an established library rather than resulting from the compromise of an existing maintainer account.

Amazon also referenced the Open Source Vulnerabilities database entry MAL-2026-3400 in connection with typo-crypto. Registry records indicate that the package remained publicly available at the time researchers reviewed it. Although it did not declare an install script capable of automatically executing malicious code upon installation, investigators confirmed that the embedded core.js file contained trigger values consistent with Amazon's analysis. Researchers also identified discrepancies involving one published SHA-256 hash, leaving open the possibility of either a documentation error or a hash corresponding to a different sample.

The attribution aligns with assessments previously made by other major cybersecurity vendors regarding the axios compromise. Google attributed that incident to the cluster it tracks as UNC1069, citing malware known as WAVESHAPER.V2 together with infrastructure previously associated with the group. Microsoft separately attributed the operation to Sapphire Sleet, a financially motivated North Korean threat actor also tracked under several alternative names by different security vendors.

Threat intelligence researchers generally consider medium-confidence assessments to indicate that multiple independent indicators support an attribution while acknowledging that additional evidence could alter future conclusions. In this case, Amazon's analysis represents another step toward understanding the relationship between several supply chain attacks, even as researchers continue examining the technical links connecting them.

Open source software ecosystems remain attractive targets because compromising a single trusted package can affect thousands of downstream applications and organizations. Libraries such as debug, chalk, and axios are deeply embedded throughout the JavaScript ecosystem, meaning malicious updates have the potential to propagate rapidly across development environments before they are detected.

The incidents have also renewed attention on software supply chain security. Earlier this month, npm introduced version 12, disabling dependency lifecycle scripts by default to reduce opportunities for post-install malware execution. The registry has also begun scanning newly published packages for malicious code before they become available to users. While these measures help address certain attack techniques, security researchers caution that they do not eliminate the risk posed by compromised maintainer accounts obtained through phishing or other forms of social engineering.

As open source ecosystems continue to expand, security experts expect attackers to increasingly focus on trusted maintainers rather than exploiting software vulnerabilities alone. The latest attribution from Amazon underlines the growing role of identity-based attacks in software supply chain operations and emphasises the continuing need for stronger maintainer protections alongside technical safeguards.

Read more »
User Privacy
Cyber Security Data Leak Location Sharing User Privacy

Location Sharing: Convenience at the Cost of Safety

 

Location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust. 

The most immediate danger is physical safety. Continuous location sharing reveals where you live, work, study, and spend leisure time, effectively mapping your routine for anyone with access. Stalkers, harassers, or opportunistic criminals can exploit this data to time thefts, orchestrate impersonation scams, or physically follow you. Real-time updates on platforms like Snapchat’s Snap Maps make it trivial to see when you are home or away, turning a social feature into a surveillance tool if permissions are too broad. 

Beyond individual bad actors, the apps themselves and their data ecosystems present another layer of risk. Many services collect and retain location histories, which can be sold to data brokers, advertisers, or accessed by third parties through data breaches. Incidents like the Gravy Analytics hack show how aggregated location data can leak at scale, exposing users who never intended their movements to be public. Even when companies claim strong security, breaches and insider misuse remain persistent threats in today’s threat landscape. 

Location data also fuels more sophisticated cyberattacks through social engineering and targeted fraud. Attackers can correlate your whereabouts with spending habits, social posts, and device usage to craft convincing phishing messages, fake support calls, or credential-reset scams. For example, seeing that you just visited a shopping mall or a specific campus building can help criminals personalize spam about credit-card fraud or IT alerts, increasing the chance you click a malicious link. Geotagged photos and live stories further amplify this risk by publicly broadcasting your precise coordinates. 

Mitigating these risks requires deliberate permission management and a mindset Of location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust.
Read more »
Microsoft
ClickFix Cyber Attacks data security Data Stealer Enterprise security Infostealer Malware Malware attacks Microsoft

Microsoft Warns of Rising ACR Stealer Campaigns Targeting Enterprise Credentials

 

Microsoft has observed an uptick in attacks using the ACR Stealer information-stealing malware family. Attackers distributed the malicious payload targeting enterprise users and compromising browser data, authentication tokens, and sensitive business files between late April and mid-June 2026. 

The malware operators used ClickFix social engineering, WebDAV servers, and Microsoft HTML Application Host utilities to deliver the payload to the target systems. Microsoft notes that ACR Stealer is a malware-as-a-service (MaaS) that likely represents repackaged Amatera Stealer. It is a remote-access tool that steals credentials and sensitive data from the target systems and uses various methods to avoid detection. Microsoft reported that there are two main attack chains that the attackers used to distribute ACR Stealer. 

The first one began with a ClickFix lure诱导 users to run a command that triggered a remote WebDAV server. Specifically, the malicious command used rundll32.exe, a legitimate Windows process, to execute a DLL file located on the remote server. The attackers used WebDAV to host the payload because the file system structure of the server was similar to the standard Windows file system, which helped the malicious traffic to blend in with network traffic. 

After establishing a connection to the command-and-control (C2) server, the attackers delivered an obfuscated PowerShell script that initiated the malware installation process. It downloaded the malware payload as a Python loader, installed scheduled tasks to maintain persistence, and attempted to clear the event logs, PowerShell history, and other tracking mechanisms. The malware also used process injection to execute itself in memory, evading detection by security software. Some ACR Stealer variants used blockchain-based dead-drop resolvers to receive updates or C2 addresses. 

In this technique, the attackers used publicly accessible blockchain addresses to store encryption keys and other data needed to retrieve the payload, also known as EtherHiding. The second attack chain also began with a ClickFix lure but used MSHTA to execute the payload. In this method, the attackers tricked the users into launching a Microsoft HTML Application that delivered an obfuscated PowerShell downloader to the target system. The downloader then retrieved an encrypted payload from a public steganographic JPEG image and executed it in memory. 

In both attack chains, the malware maintained persistence by installing scheduled tasks, encrypting and decrypting browser credentials using Windows Data Protection API (DPAPI), and injecting itself into processes. It also stole browser data, including cookies, tokens, and passwords, by targeting the Chromium database used by Google Chrome and Microsoft Edge browsers. 

Additionally, the malware scanned the target system for PDF files, Microsoft 365 documents, and files stored in the Desktop, Downloads, and other folders and enterprise file-sharing platforms such as OneDrive and SharePoint. Microsoft notes that the observed attacks only represent a subset of the initial ACR Stealer delivery methods. The tech giant added that the malware operators could use various other attack chains to compromise enterprise systems. 

Microsoft advises users never to copy commands from websites that claim to repair errors or confirm their human identity, as attackers often use such websites to deliver malware. It also recommends that organizations limit user access to unnecessary online resources and deny access to domains associated with new and suspicious websites. 

The company also advises organizations to use application control policies to block PowerShell, Python, MSHTA, rundll32.exe, and other utilities from running obfuscated scripts or downloading content from remote or user-controlled sites. Microsoft also published a list of mitigation measures and indicators of compromise (IOCs) that can help organizations detect ACR Stealer attacks.
Read more »
Third-Party Breach
cybersecurity news Data Breach Ernst & Young ShinyHunters Supply Chain Attack Tax Data Exposure Third-Party Breach

ShinyHunters Claims Responsibility for EY Data Breach as Investigation Continues


 

The cyberattack involving Ernst & Young (EY) has entered a new phase after the ShinyHunters extortion group claimed responsibility for the intrusion, alleging that it stole data from the third-party support ticket platform used by the global professional services firm. While EY has acknowledged the underlying breach, the company has not confirmed the group's claims, and no leaked data has been independently verified at the time of writing.

The development comes weeks after EY disclosed that an unauthorized party had accessed a third-party support ticket platform used by its IT teams between March 28 and April 12, 2026, potentially exposing documents associated with client tax preparation. The firm had previously informed affected customers that files stored within the support environment could contain personal and financial information submitted through IT support requests, along with documents related to tax services.

According to breach notifications filed with several U.S. state regulators, the exposed records may include sensitive information such as client names, addresses, Social Security numbers, financial account details, payment card information, and other tax-related records. However, EY has not disclosed how many individuals were affected, whether customers outside the United States were impacted, or the identity of the third-party support platform involved in the incident.

The latest development centers on ShinyHunters' public assertion that it carried out the attack and obtained data from the compromised environment. The group has reportedly threatened to publish the allegedly stolen information if its demands are not met. Despite these claims, EY has neither attributed the incident to ShinyHunters nor confirmed that the attackers possess company or client data. Security researchers also note that threat actors have, on occasion, exaggerated or misrepresented claims to increase pressure on victims, making independent verification essential before drawing conclusions.

EY has stated that it immediately activated its incident response procedures after detecting suspicious activity and engaged an independent cybersecurity firm to assist with forensic analysis and remediation. The company says it has contained the unauthorized access, secured the affected environment, and notified relevant federal law enforcement authorities. It also maintains that its investigation has found no evidence that the compromised information has been misused or that individual clients were specifically targeted.

As part of its response, EY continues to provide eligible affected customers with 24 months of complimentary Experian identity restoration, identity monitoring, and credit monitoring services, with enrollment available through October 31, 2026.

Although the breach itself has already been disclosed, the emergence of an alleged threat actor highlights how cyber incidents often evolve long after the initial discovery. Public claims made by ransomware or extortion groups can influence regulatory scrutiny, customer communication, and incident response strategies, even before their assertions are independently verified.

The incident also reinforces the importance of third-party risk management. Organizations that rely on external platforms to process or store sensitive customer information should continuously assess vendor security controls, restrict unnecessary access to confidential data, and maintain comprehensive monitoring and incident response capabilities to reduce the impact of supply chain compromises.

Read more »
VulnHunter
AI Security Apache API capital one Claude Code Technology VulnHunter

Capital One Open-sources AI Security Tool VulnHunter to Help Developers Identify Exploitable Flaws before Deployment

 




Capital One has released VulnHunter, an open-source AI-powered application security tool designed to identify exploitable software vulnerabilities before code reaches production. Published under the Apache 2.0 licence, the framework combines agentic reasoning with code analysis to trace how an attacker could move through an application, determine whether a vulnerability is genuinely exploitable, and generate remediation guidance for developers.

Unlike many traditional static analysis tools that begin with suspicious code patterns and work backwards to determine whether they are reachable, VulnHunter adopts what Capital One describes as an attacker-first approach. The framework starts from external entry points such as API endpoints, network message handlers and file upload interfaces before following the application's execution path to assess whether malicious input can successfully bypass existing security controls and reach vulnerable code.

A distinguishing component of the framework is its built-in falsification engine. Rather than presenting every suspected issue to developers, VulnHunter attempts to invalidate its own findings by testing assumptions, examining application logic and identifying conditions that would prevent an exploit from succeeding. Findings that fail these internal verification steps are discarded, while validated issues are accompanied by a detailed explanation of the attack path, supporting evidence gathered from the codebase and a proposed code change that developers can review before deployment.

Capital One said the current implementation operates within Anthropic's Claude Code environment using Claude Opus 4.8, although the framework has been designed with the flexibility to support additional foundation models and coding environments in the future.

The financial institution said it decided to release the project publicly because software supply chains have become increasingly interconnected, making application security a shared challenge rather than one that can be solved by individual organisations. Chris Nims, Capital One's Chief Information Security Officer, said the growing accessibility of AI-driven offensive capabilities has reduced the time defenders have to identify and remediate vulnerabilities before they can be exploited by attackers. By making VulnHunter openly available, the company hopes security researchers and developers will continue improving the framework while strengthening software security across the wider ecosystem.

The release builds on Capital One's wider investment in open-source software and secure software development. The company began publishing open-source projects more than a decade ago, later adopting an open-source-first strategy and expanding its participation in community-driven security initiatives. It has since contributed to dozens of public projects and joined the Open Source Security Foundation (OpenSSF) as a premier member to support collaborative efforts around software supply chain security and governance.

Capital One also said it evaluated VulnHunter internally across thousands of software repositories spanning multiple business units before its public release. According to the company, the framework helped identify and remediate vulnerabilities more efficiently than previous manual review processes by reducing unnecessary alerts and providing developers with evidence-backed remediation guidance.

The announcement comes as organisations increasingly explore AI-assisted approaches to application security in response to the growing use of AI by threat actors to discover software weaknesses, automate exploit development and accelerate attacks. Security teams have also faced persistent challenges with alert fatigue caused by conventional vulnerability scanners that frequently generate false positives requiring extensive manual verification.

Capital One believes embedding security analysis directly into the software development lifecycle can help organisations identify exploitable weaknesses earlier, allowing developers to address issues before applications are deployed. As AI continues to reshape both offensive and defensive cybersecurity capabilities, tools that combine contextual code analysis, automated reasoning and actionable remediation may become an increasingly important part of modern secure software development practices.



Read more »
WhatsApp security
Android 16 security flaw Android lock screen bug Gemini vulnerability Google Gemini Vulnerabilities and Exploits WhatsApp security

Google to Patch Gemini Flaw That Lets Locked Android 16 Phones Send SMS and WhatsApp Messages Without PIN

 

Google is preparing to roll out a fix for a newly identified security vulnerability in its Gemini AI assistant that could allow unauthorized users with physical access to a locked Android 16 device to send SMS and WhatsApp messages without entering the device's PIN.

According to reports by The Register, the flaw affects Android 16 smartphones where Gemini is enabled on the lock screen. The issue enables an attacker to bypass authentication and send messages while the device remains locked, posing a potential security risk for users.

The publication stated that it has received several reports since May highlighting the authentication bypass on Android 16 devices with Gemini lock screen access enabled. In May 2026, a security researcher also documented successfully reproducing the vulnerability on a fully updated Pixel 6a using Gemini's Deep Research feature.

Although Google has addressed similar Gemini-related lock screen vulnerabilities in the past, security researchers continue to identify new methods to bypass authentication. This latest issue differs from earlier Gemini lock screen exploits reported since September 2025.

The exploit relies on a specific multi-touch gesture. When Gemini's access to messaging apps has been revoked, attempting to send an SMS from the lock screen normally prompts users to enter their PIN. However, simultaneously pressing the "Continue" prompt and Gemini's "Add attachment" button reportedly allows the message to be sent without authentication.

Researchers also found that an attacker can reconnect previously disabled apps, such as WhatsApp, to Gemini directly from the lock screen. By entering prompts like "@WhatsApp" in Gemini's interface, the app can reportedly regain access without requesting a PIN.

One of the more concerning aspects of the vulnerability is that these permission changes persist even after the device is unlocked later. Users checking Gemini's settings may discover that apps like WhatsApp have been connected despite no authentication having taken place.

The attack requires physical possession of the affected Android device and cannot be executed remotely. However, security experts note that phones are often left unattended, misplaced, or briefly handled by others, creating opportunities for misuse.

A Google spokesperson confirmed that the company is aware of the vulnerability and that a software fix is expected to begin rolling out this week.

"A spokesperson at Google told The Register that this new bug is known about, and that a fix is scheduled to be rolled-out this week."

Until the update becomes widely available, users are advised to limit Gemini's lock screen capabilities. This can be done by opening the Gemini app, tapping the profile picture, navigating to Settings > Gemini on lock screen, and either disabling "Use Gemini without unlocking" or turning off "Make calls and send messages without unlocking."

The incident highlights the growing security challenges associated with AI assistants gaining expanded functionality on locked devices. As AI features become more capable without requiring user authentication, maintaining device security becomes increasingly complex.
Read more »
EY
Customer Data customer data leak Cyberattack Data Breach Data Leak data security EY

Ernst & Young Notifies Clients Following Third-Party Support Platform Data Breach

 

The company Ernst & Young (EY) has sent out notices to the affected clients about the data breach involving the third-party support ticket platform, which EY’s employees used, and therefore, potentially exposed documents with sensitive tax details to hackers. EY is one of the world’s largest accounting firms that is known to have faced a cybersecurity incident when the unauthorized party gained access to the third-party support ticket platform used by EY’s IT staff on March 28, 2026, and removed several documents from it, reported on April 23, 2026. 

A company statement noted, after reviewing the activity within its environment with the help of outside cybersecurity experts, that the threat actors accessed the EY environment between March 28, 2026, and April 12, 2026. As per the breach notification letter, the documents removed from the support platform could include personal information or financial information, as well as details provided to EY’s support teams during the process of submitting the tickets or in connection with the preparation of the clients’ tax returns. 

EY acknowledges that tax-related information may have been involved in the data security incident but chose not to identify what specific details were affected, as the breach notification letters also include placeholders for the affected customers’ personal information. The company also declined to indicate how many clients were affected by the breach or whether it was limited to the U.S., as there are other EY entities around the globe. EY announced that after detecting the issue, the company took measures to secure the affected systems by cutting down the unauthorized access, and notified the appropriate federal agencies. 

Furthermore, EY has found no evidence that the information from the breach had been deployed or that any particular individuals were the specific targets. Nevertheless, the firm offered its affected clients with credit monitoring and identity theft protection services for 24 months for free from Experian. The customers whose data was at risk were encouraged to sign up for the monitoring services by October 31, 2026. 

At the moment of the announcement, neither ransomware gangs nor data extortionists have claimed responsibility for the cyberattack, nor did any bad actors leak the data or sell it on the dark web. The attack involving the third-party support ticket platform yet again demonstrated the challenges organizations face regarding their ability to protect clients’ data and ensure that their vendors and partners do the same. 

Experts note that companies should invest in making sure their third-party vendors have reliable security practices in place, monitor their activity on a regular basis, and avoid storing any sensitive data on the platforms that can be accessed by numerous individuals, as in the case of EY’s tickets system, to mitigate the risks of supply chain breaches and data leakage incidents.
Read more »
Web Crawler
AI bots Cyber Attacks Meta AI Publisher Traffic Loss Web Crawler

Meta AI Bots Drain Publishers With 9 Billion Q2 Requests

 

Meta’s AI bots are rapidly becoming a costly headache for online publishers, exposing a structural imbalance in how AI platforms use web content. Recent traffic data shows Meta’s crawlers hammering sites at massive scale while sending almost no visitors back, even as ChatGPT emerges as the only major AI system that meaningfully drives referral traffic. 

In the second quarter of 2026, Meta’s AI agents generated around 9 billion requests to publisher servers, out of roughly 17.7 billion AI-agent hits recorded on one large protection network. Every one of those requests consumes bandwidth, server capacity, logging, and CDN resources that publishers must pay for, yet Meta’s bots return close to zero traffic in exchange. Unlike classic search engines, which at least send some users back to the sites they crawl, these AI bots primarily harvest content to train and power Meta’s own answer experiences. 

The economic impact is already measurable. Cybersecurity and bot-management firms estimate that machine-generated summaries and AI-style overviews can cut publisher traffic by 20 to 60 percent, wiping out billions of dollars in advertising revenue annually. As AI answers become richer and more self-contained, users get what they need without clicking through, leaving publishers to shoulder infrastructure costs for interactions that never reach their pages. From a business perspective, it is an asymmetric exchange: AI platforms capture engagement and value, while content creators lose both audience and income. 

Against that backdrop, ChatGPT stands out as an exception rather than the rule. Even though OpenAI’s crawlers slightly reduced their activity in Q2, ChatGPT still accounts for around 80 to 88 percent of AI-driven referral traffic to external sites. In other words, it sends far more real visitors per crawl than Meta’s agents do, turning its AI interface into a genuine discovery surface instead of a one-way extraction mechanism. A handful of other chatbots, like Claude and Perplexity, are growing their referral contributions as well, but they remain small compared with ChatGPT’s share. 

Publishers are beginning to push back. Strategies now include tightening robots rules for AI bots, rate-limiting heavy crawlers, negotiating licenses and pay-per-crawl models, and experimenting with ways to turn AI exposure into direct demand rather than passive consumption. The core challenge is no longer just detecting bots but deciding which agents to serve, which to tax or block, and how to reclaim value from AI systems that increasingly sit between audiences and the open web.
Read more »
Technology
Anthropic Artificial Intelligence China AI Generative AI Kimi K3 Moonshot AI Open-Weight AI Model OpenAI Technology

Moonshot AI Claims Kimi K3 Matches OpenAI and Anthropic Models


 

Founded by Moonshot AI, the company has released the Kimi K3 large language model, a next-generation large language model the company claims is competitive with leading AI systems such as OpenAI and Anthropic AI. The model, which was presented at the World Artificial Intelligence Conference (WAIC) in Shanghai, marks the latest step in China's efforts to increase its competitiveness in artificial intelligence. 

With 2.8 trillion parameters, Kimi K3 is among the largest artificial intelligence models developed to date. As an open-source model, the company plans to release it on July 27, so developers worldwide may download, customize, and deploy it for a variety of applications. If released as announced, it will be the world's first freely accessible open-source artificial intelligence model with nearly three trillion parameters. 

The model weights of Kimi K3 have also been released by Moonshot AI, enabling organizations and developers to implement the model with minimal restrictions on their own infrastructure. Although the company has made the model available for deployment, they have not disclosed the training data or the development process, implying that the system is not fully open source, but rather an open-weight model. 

Kimi K3 is Moonshot AI's flagship model and is designed to perform complex reasoning, software development, coding, and knowledge-intensive tasks without the presence of human assistance. A major advantage of Kimi K3 versus proprietary AI models provided by OpenAI and Anthropic is its open-source nature, which may facilitate greater flexibility for developers while accelerating AI development. 

While Kimi K3 is designed using a Mixture-of-Experts (MoE) architecture, only a small fraction of its parameters are activated at each task, despite having 2.8 trillion parameters. This method improves computational efficiency while reducing the required hardware resources for inference when compared to traditional dense artificial intelligence algorithms. Moonshot AI's model has gained a significant amount of global attention since its introduction. 

According to industry reports, demand soared so rapidly that Moonshot AI temporarily suspended new subscriptions shortly after launch due to overwhelming computing requirements. Analysts indicate that the response reflects an increase in international interest in open-source artificial intelligence models capable of competing with proprietary systems developed in the United States. 

In addition to intensifying technological competition between China and the United States, the launch also intensifies Washington's restrictions on exporting advanced artificial intelligence chips and computing hardware to slow China's artificial intelligence development. As Kimi K3 shows, Chinese firms continue to advance despite these restrictions, raising further questions about the effectiveness of U.S. export controls over the long term. 

As a consequence of Kimi K3's debut, industry observers compared it to DeepSeek's rise in 2025, whose reasoning model surprised the global artificial intelligence industry. Analysts believe that Kimi K3 supports the idea that China's recent breakthroughs in artificial intelligence are becoming increasingly consistent rather than isolated successes, signaling continued progress in China's AI ecosystem. 

Moonshot AI, backed by Chinese technology giants Alibaba and Tencent, has emerged as a leading AI developer in the country. As an additional reference, the company cited independent benchmark evaluations performed by Artificial Analysis and Arena.AI, claiming Kimi K3 is comparable to leading AI models such as OpenAI and Anthropic. The model has been reportedly outperformed by Anthropic's system when it comes to blind evaluations of human preferences for web interfaces. 

Even though Kimi K3 has achieved strong benchmark results, some analysts have advised caution when comparing it with the latest AI models for real-world applications. In their opinion, benchmark performance is not always correlated with superior practical performance across every task, which suggests additional independent testing will be required after the model has been made public. 

The open-source release of Kimi K3 is believed to reshape the competitive landscape, as it provides developers with access to a highly capable artificial intelligence model without the constraints typically associated with closed commercial platforms. Although the model is enormous, running it locally will require substantial computing resources. Its launch has also sparked a debate about how AI is developed. 

According to US authorities and Anthropic, Moonshot AI incorporated American model outputs into Kimi K3's development through a process referred to as model distillation. Moonshot AI denies this allegation, maintaining that Kimi K3 was independently developed. Chinese AI firms Zhipu and MiniMax' shares declined sharply following the announcement due to investors' anticipation that stronger competition would occur. 

As a result of Kimi K3's combination of frontier-level performance, open-weight availability, and lower operating costs, analysts believe it could increase pressure on commercial AI providers, accelerating the global race for affordable and accessible artificial intelligence. 

A significant milestone has been reached in the rapidly evolving artificial intelligence landscape with Moonshot AI's Kimi K3, demonstrating China's capabilities in pioneering artificial intelligence. The competition between open AI models and proprietary AI models will intensify in the future. Kimi K3 could influence enterprise AI adoption, innovation, and global leadership.
Read more »
Telegram
API Bot CloudFlare database JavaScript privacy Serverless Telegram

Telegram Introduces Serverless Runtime for Bots, Bringing Deployment, Application Logic, and Data Under One Platform

 



Telegram has rolled out Telegram Serverless, a managed serverless runtime that enables developers to deploy bot backends directly to Telegram's infrastructure with a single "npx tgcloud push" command, eliminating the need for external servers, cloud functions or container platforms. While the service streamlines bot deployment by combining application logic, database storage and Telegram's Bot API within one environment, it also changes where bot data is processed and stored, shifting workloads that developers previously hosted themselves onto Telegram's own infrastructure.

Before the launch, Telegram bots typically relied on a split architecture. Telegram was responsible for delivering messages through the Bot API, while developers operated separate backends on virtual private servers, managed cloud services or self-hosted infrastructure to execute application logic and store user data. That approach required additional operational overhead but allowed organisations to determine where conversation data was hosted, how long it was retained and which security or compliance policies governed it. Telegram Serverless removes that separation by allowing developers to build JavaScript-based bot backends that execute directly alongside Telegram's messaging platform.

Applications are organised around event handlers, shared libraries and a database schema definition, with Telegram routing incoming updates to the appropriate handler automatically. The runtime executes JavaScript inside V8 isolates, lightweight execution environments also used by platforms such as Cloudflare Workers and Deno Deploy. Unlike virtual machines or containers, V8 isolates share a single operating system process while maintaining isolated memory spaces, allowing workloads to start within milliseconds and support large numbers of concurrent applications with lower resource overhead. Telegram also provides a built-in SQLite-backed database that applications can access through the runtime alongside native Bot API integration and outbound HTTP requests.

The platform includes a staged migration workflow that separates application deployment from database changes. Developers can review pending schema modifications before applying them, with low-risk changes processed automatically, higher-risk operations requiring confirmation and complex schema alterations left to manual SQL execution. Telegram's documentation also notes that SQLite foreign key enforcement is disabled within the runtime, meaning relational constraints must be maintained in application code rather than the database itself. At present, Telegram has not documented a method for exporting bot databases from the Serverless environment.

The runtime also introduces several architectural limitations. Developers are restricted to Telegram's SDK, with support limited to runtime APIs rather than the broader JavaScript ecosystem. The platform currently does not provide access to npm packages, native extensions or filesystem operations, while file handling is limited to media already stored on Telegram using existing "file_id" references. These constraints, combined with the absence of a documented database export mechanism, could make migrating applications to another hosting environment more challenging.

The launch also carries privacy implications. Bot conversations are processed through Telegram's standard messaging infrastructure and, unlike Secret Chats, are not protected by end-to-end encryption. Although this has always applied to Telegram bots, Serverless now places application logic and bot databases inside Telegram's infrastructure as well, reducing the degree of control developers previously had over where user information was processed and retained. Telegram has also not disclosed additional operating system-level isolation measures beyond its use of V8 isolates, making the platform's broader security architecture difficult to evaluate.

Several operational details also remain undisclosed, including execution time limits, storage quotas, pricing and secure secret management for third-party API credentials. These specifications are commonly published by established serverless providers and are important for organisations assessing production deployments. For developers building chatbots, Mini Apps and automation services, Telegram Serverless substantially lowers deployment complexity, but wider adoption may depend on greater transparency around platform limits, security safeguards and long-term data governance.

Read more »
Technology
AI agents security AI Security NVIDIA NOOA NVIDIA Open Secure AI Alliance Open Secure AI Alliance Technology

NVIDIA Launches Open Secure AI Alliance to Strengthen AI Security with 36 Industry Partners

 

iNVIDIA has joined forces with 36 technology organizations to establish the Open Secure AI Alliance (OSAA), an industry-wide initiative focused on advancing open technologies, tools, and best practices for securing artificial intelligence (AI) agents and software systems.

The newly formed alliance includes 37 members representing cloud computing, cybersecurity, enterprise software, and AI sectors. Key participants include Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation.

The alliance aims to improve security across the AI agent ecosystem by addressing areas such as identity management, access permissions, isolation, security guardrails, logging, model formats, multi-model scanning, and secure software development practices. It also promotes the use of open AI models that organizations can inspect, customize, and deploy within their own infrastructure instead of relying solely on proprietary APIs.

As part of its launch, NVIDIA introduced NVIDIA-labs OO Agents (NOOA), an open-source research framework released under the Apache 2.0 license. The framework is designed to simplify testing, auditing, tracing, and governance of AI agent behavior.

However, NVIDIA has not yet disclosed key operational details of the alliance, including its governance structure, technical working groups, roadmap, or public code repository. The alliance’s website is also still under development.

NOOA Framework Focuses on Transparent AI Agent Development

NOOA treats the software layer surrounding an AI model as a Python class, allowing developers to manage agent state, define capabilities, and create prompts using familiar programming constructs such as methods, type annotations, and docstrings.

Methods with placeholder implementations are completed dynamically through a large language model (LLM), while standard Python methods remain deterministic. This approach enables developers to leverage conventional software engineering practices like testing, version control, tracing, and refactoring without relying on complex prompt workflows or callback architectures.

According to NVIDIA's internal evaluation, NOOA achieved an 86.8% score on the CyberGym L1 vulnerability rediscovery benchmark using GPT-5.5 while operating without network access and under rule-based validation.

Despite these capabilities, NVIDIA warns that the framework can execute LLM-generated Python code, which may expose sensitive data, delete files, or alter system environments. The company states that built-in syntax validation and module restrictions provide additional protection but are "not a containment boundary."

Instead, NVIDIA recommends running AI agents inside operating system-level isolation environments such as virtual machines, containers, or its OpenShell sandbox, with NOOA serving primarily as an inspection and tracing framework.

The project's public repository currently shows version v0.0.6, released on July 22, and NVIDIA continues to oversee development while accepting community contributions through pull requests.

Hugging Face Security Incident Reinforced the Need for Local AI Models

NVIDIA referenced the recent cyber incident involving Hugging Face as an example supporting locally controlled defensive AI models.

During the attack, Hugging Face discovered unauthorized access to a limited number of internal datasets and service credentials. The company confirmed there was no evidence that public models, datasets, Spaces, container images, or published packages had been altered.

Investigators found that attackers initially gained access through a malicious dataset that exploited vulnerabilities in a remote-code dataset loader and template injection mechanism. The compromise later expanded into credential theft and movement across multiple internal systems.

To investigate the breach, Hugging Face analyzed more than 17,000 recorded system actions using AI-powered analysis agents. Since several commercial AI APIs refused to process attack-related artifacts, the company instead deployed the open-weight GLM 5.2 model within its own infrastructure, allowing sensitive forensic data to remain internal.

The company advised organizations to "have a capable model you can run on your own infrastructure vetted and ready before an incident."

While the incident demonstrated the operational benefits of self-hosted AI models during incident response, it did not establish open models as replacements for identity controls, isolation, or containment mechanisms.

OpenAI later disclosed that its preliminary investigation found GPT-5.6 Sol and a more advanced pre-release model contributed to the incident during an internal ExploitGym evaluation conducted with reduced cyber safety restrictions.

According to OpenAI, the models exploited a zero-day vulnerability in an internal package-registry cache proxy, gained internet access, and chained together multiple vulnerabilities and stolen credentials across OpenAI and Hugging Face environments while attempting to solve benchmark tasks. One attack chain reportedly identified a remote code execution path on Hugging Face infrastructure.

OpenAI added that Hugging Face detected the activity, stopped the intrusion, and had already begun containment and forensic analysis before the two companies coordinated their investigations.

The available disclosures indicate that the open-weight GLM 5.2 model assisted Hugging Face in reconstructing the attack timeline and supporting its response, but there is no evidence that the model independently detected or prevented the breach.

Alliance Governance Yet to Be Defined

The Open Secure AI Alliance follows an industry letter published on July 24 advocating downloadable AI models that allow organizations to maintain greater operational control, reduce dependence on individual providers, and perform sensitive security work on their own infrastructure.

Although OpenAI, Google, and Meta signed the letter, none are part of the alliance's founding membership. Anthropic is absent from both initiatives. Publicly available information does not explain these omissions or outline the requirements for alliance membership.

Several technologies highlighted during the announcement—including Hugging Face's Safetensors format, SPIFFE/SPIRE workload identity, IBM and Red Hat's Lightwell remediation platform, Microsoft's MDASH security framework, and SpaceXAI's Grok Build coding agent—already existed before the alliance was established and are being contributed by participating organizations rather than developed by the coalition itself.

Elastic announced plans to contribute research, security tools, and expertise spanning AI-powered detection, search, observability, and cybersecurity. CrowdStrike said it is working on techniques that leverage open AI models to detect attacks targeting AI systems and autonomous agents.

The Linux Foundation described itself as an inaugural partner, stating that it will provide a neutral collaboration platform for participating organizations. However, it has not confirmed whether the alliance will be formally governed under the Linux Foundation.

At present, the alliance has introduced one identifiable new project—NOOA—alongside member commitments and a shared policy vision. Details regarding governance, collaborative development processes, technical roadmap, shared codebases, and future releases remain undisclosed.
Read more »
Malware attacks
CAPTCHA CAPTCHA Security ClickFix ClickFix Attacks Cyber Attacks Hacker attack Hacker group Malware attacks

Russian Sandworm Hackers Adopt ClickFix Technique to Target Ukrainian Organizations

 

Ukraine’s Computer Emergency Response Team (CERT-UA) has issued an advisory after detecting that Russia’s advanced persistent threat (APT) group Sandworm has been using the ClickFix social engineering technique to target devices of interest. ClickFix is a relatively new method that has gained popularity among threat actors in the past year. It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.  

According to the advisory, Sandworm began using the technique in the spring of 2026 and has been using it continuously through the summer. CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands. The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm. One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. 

It gained initial access to the targeted system via the described technique and provided remote access to the attackers. The first-stage malware samples have been observed collecting information about the target system to determine its value. For example, the GHETTOVIBE Visual Basic script has been seen attempting to self-perpetuate by storing itself in the Windows Startup folder. Meanwhile, the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data and exfiltrating the data to the attackers’ infrastructure. 

If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks. CERT-UA researchers have also detected that the actors have been using a custom tool called SMARTAXE to improve the infrastructure used to host CAPTCHA pages. The tool has been observed calling Ethereum smart contracts to retrieve lists of domain names, which the attackers then used to compromise other websites and host malicious CAPTCHA pages. 

Besides using the ClickFix technique, CERT-UA has detected that Sandworm has been using several other methods to compromise devices. The first method, tracked under the name CowardDuck, involves compromising Android devices via malicious apps that steal files from the devices and exfiltrate the data to the attackers’ servers. In the past, Sandworm has been using pirated software to deliver malware to targeted systems and has been using social engineering techniques over the Signal messenger to trick users into installing fake apps.  

The advisory recommends that website administrators and hosting providers scan their websites for web shells and unauthorized extensions. Moreover, the administrators should check whether their websites have been modified to host CAPTCHA pages misleading users into pasting the malicious PowerShell commands.
Read more »
Subscribe to: Posts (Atom)