Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Meta’s Muse AI: How Instagram Users Can Opt Out After Privacy Backlash

 

Meta’s short‑lived Muse Image AI on Instagram let users remix public photos into AI images by default, triggering a storm of privacy and consent backlash before Meta pulled the feature. Meta’s Muse Image tool was designed to turn Instagram into a generative AI playground, allowing people to create new images using photos from any public account. 

By tagging a public handle in an AI prompt, users could generate stylised visuals that borrowed someone else’s likeness or feed without ever asking permission. Meta framed Muse as a creative upgrade, promising strong safety guardrails and quick controls for those who wanted to opt out. But that framing collapsed almost immediately once people realised just how much quiet data sharing sat behind the feature.  

The core problem was consent: adult users with public profiles were opted in automatically, with no upfront notice or explicit choice. Anyone could be remixed into AI art by strangers simply because their account wasn’t private. Reports showed Muse could generate images of people who had never interacted with the tool at all, including photos featuring children who obviously couldn’t consent to such reuse. To make matters worse, Meta’s own policy confirmed users would not be notified when their content was used in AI features, keeping the whole process largely invisible.  

Creators, unions and privacy advocates quickly denounced the opt‑out model as an inversion of basic digital rights. Hollywood unions and talent agencies warned that Muse normalised non‑consensual manipulation of someone’s image and could undermine control over professional likeness and copyrighted work. Digital rights groups called the rollout a “privacy landmine”, pointing to existing harms from deepfakes and non‑consensual AI imagery elsewhere on the internet. Their argument was simple: protection should be the default, and any AI reuse of identity should require explicit, informed opt‑in.  

Under pressure, Meta stressed that private accounts and users under 18 were automatically excluded from Muse, and that any public user could disable the feature with a few taps in Instagram’s Sharing and Reuse settings. Users could also flip their profile to private to lock themselves out of AI remixes entirely. But critics noted these controls were buried, easy to miss and did nothing to remove AI images already generated from someone’s posts. For many, this reinforced the sense that meaningful control arrived only after the data had already been exploited.  

Within days of launch, the backlash forced Meta to pause and then remove the Instagram implementation of Muse Image, admitting the feature “missed the mark” on user expectations. The episode has become a case study in how not to roll out AI features on social platforms, especially when they touch identity and consent. It underscores a wider shift in user sentiment: AI creativity is welcome, but only when people remain clearly informed, empowered and in control of how their content trains or feeds the machine.

Music Industry Introduces Voluntary AI Labels to Improve Transparency in Recordings

 

Several leading music industry organisations have introduced a new voluntary labelling framework for recordings created using generative artificial intelligence (AI), aiming to improve transparency for listeners and encourage wider adoption across the global music ecosystem. 

The initiative, announced on July 10, is backed by the International Federation of the Phonographic Industry (IFPI), the Recording Industry Association of America (RIAA), the Recording Academy (Grammys), and six other industry bodies. 

Highlighting the need for greater transparency, the chief executives of IFPI and RIAA said in a joint statement, "Fans want to know whether and how generative AI has been used. These labels will provide an immediately understandable and easily scalable approach to transparency." 

The framework introduces two categories of labels. The first, "AI-generated," is intended for recordings where artificial intelligence is responsible for generating the entire recording or the majority of its creative elements. This includes music created entirely from AI prompts, as well as tracks featuring AI-generated lead vocals or key instrumental components. 

The second category, "AI-assisted," applies to recordings that remain primarily human-created while incorporating certain AI-generated expressive elements. Under this classification, lead vocals and primary instrumental performances must still be delivered by human artists. 

The organisations said the voluntary system is designed for broad global adoption and could eventually be implemented by music streaming platforms to provide listeners with greater clarity about how AI is used in music production. 

The announcement comes as streaming platforms continue to experience a rapid increase in AI-generated music. Deezer currently identifies AI-generated tracks on its platform and recently reported that nearly half of all new uploads contain AI-generated content. In June, the company also introduced an AI music detection tool that it claims delivers 99.8% accuracy. 

Earlier this year, an Apple Music executive told Billboard that more than one-third of newly uploaded tracks on the platform were created entirely using AI. 

Responding to the announcement, the Digital Media Association (DiMA), which represents streaming services including Apple Music, Amazon Music and Spotify, welcomed the move and said it looks forward to receiving more detailed AI-related metadata to improve transparency for listeners. 

DiMA CEO Graham Davies said, "DiMA has long advocated for the creators, owners, and distributors of music to provide accurate and timely metadata on all music released and distributed to streaming services."  

Spotify has also been expanding its efforts to address AI-generated content. In April, the company introduced its "Verified by Spotify" label to help users identify authentic artists, following earlier initiatives aimed at improving AI disclosure and preventing impersonation. 

Spotify declined to comment on the latest industry initiative, while Apple Music and the Digital Media Association did not immediately respond to media queries.

Galaxy Digital launches $5M initiative to boost Bitcoin against future quantum computing threats

 

Galaxy Digital has announced a new initiative aimed at helping the Bitcoin ecosystem prepare for the long-term cybersecurity risks posed by unprecedented advances in quantum computing, committing up to $5 million in funding for developers and researchers working on technologies designed to safeguard the cryptocurrency's cryptographic foundations. 

The announcement comes as governments, standards bodies and private-sector organizations increasingly accelerate efforts to prepare critical digital infrastructure for a future in which sufficiently powerful quantum computers could undermine many of today's encryption methods. 

The crypto financial services firm said applications are now open for its newly established Galaxy Bitcoin Quantum Readiness Initiative, which is designed to support the development of practical tools and research that could help Bitcoin transition toward quantum-resistant security over time. 

According to Galaxy, grant funding will prioritize several areas considered essential for Bitcoin's long-term resilience. These include the development of post-quantum digital signature schemes capable of replacing today's cryptographic mechanisms, tools that would help cryptocurrency wallet providers and custodians migrate users to new security standards, formal security audits of proposed implementations, and technical work evaluating quantum-resistant transaction proposals before they are introduced to the Bitcoin network. Rather than distributing funds upfront, Galaxy said grants will be awarded individually and released as development milestones are achieved. 

The initiative extends beyond developer funding. Galaxy is also establishing a dedicated research program that will publish ongoing analysis examining quantum-related risks to Bitcoin while tracking emerging mitigation strategies. In addition, the company has formed a Quantum Advisory Council consisting of specialists in quantum computing and post-quantum cryptography to evaluate grant proposals and provide technical guidance for future research efforts. 

Galaxy said it also hopes other organizations across the cryptocurrency ecosystem will participate by contributing funding, collaborating on research, or supporting open-source development that could accelerate Bitcoin's eventual transition to quantum-resistant cryptography. 

Bitcoin currently relies on elliptic curve cryptography to verify ownership of wallets and authenticate transactions. Existing classical computers are considered incapable of breaking these cryptographic protections within any practical timeframe. However, cybersecurity researchers have long warned that sufficiently advanced fault-tolerant quantum computers could eventually execute algorithms capable of recovering private keys from exposed public keys, potentially allowing attackers to forge transactions and steal digital assets if the network remains unchanged. 

Although experts broadly agree that no quantum computer currently possesses the capability to compromise Bitcoin's cryptography, many researchers argue that preparations must begin well before such systems become available. Unlike conventional software updates, major protocol changes within Bitcoin require extensive technical review, community consensus, testing and gradual deployment across a decentralized global network, making the transition to post-quantum protections a multi-year effort. 

Industry concerns have also been reinforced by research estimating the potential scale of future exposure. CryptoQuant has projected that approximately 6.9 million bitcoin, valued at roughly $461 billion at current market prices, could become vulnerable if quantum computers eventually develop the ability to defeat Bitcoin's existing cryptographic protections before the network adopts stronger security mechanisms. While researchers do not consider such a scenario imminent, they increasingly describe proactive migration planning as essential because of the time required to update wallets, infrastructure and network software. 

Preparations for the post-quantum era are also gaining momentum outside the cryptocurrency industry. The U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024, providing organizations with standardized algorithms intended to replace vulnerable public-key cryptography as quantum technology advances. 

At the same time, the U.S. Department of Commerce is investing more than $2 billion through the CHIPS and Science Act to strengthen domestic quantum computing capabilities. The funding package spans nine companies working across multiple quantum hardware approaches, reflecting the U.S. government's broader effort to accelerate quantum innovation while simultaneously preparing national infrastructure for the cybersecurity challenges that future quantum systems may introduce. 

Bitcoin was trading at approximately $66,300 on July 21, while shares of Galaxy Digital had declined roughly 8% over the previous 12 months to trade near $25.20 per share, according to market data referenced alongside the company's announcement.

AI Chatbot Usage Declines as Privacy and Trust Concerns Influence User Adoption

 

A new survey conducted by Future, the parent company of TechRadar, published today reveals the interesting truth that the adoption of AI in the sphere of consumer technology is taking place in the world. People, however, are not using AI chatbots like ChatGPT, Gemini, and Claude as consistently as they did a year ago. 

32% of respondents said that they limit their use of artificial intelligence due to privacy concerns, and another 31% said that they would rather interact with people than AI chatbots. Users believe that chatbots invade their privacy since businesses utilize them to collect, store, and process personal information. 

32% of respondents limited their use of artificial intelligence due to privacy concerns, and this number was the same as last year. It suggests that users are still concerned about the collection, storage, and processing of their data by artificial intelligence systems. 31% of respondents said that they would rather engage with people than AI chatbots. Many users, however, believe that conversational AI cannot match human interaction, even though the technology has improved significantly in recent years. As such, there has been a noticeable shift in the attitudes of consumers toward the use of artificial intelligence, especially chatbots. 

29% of respondents said that they do not require artificial intelligence for their daily tasks, which is a decrease from the same survey last year. Users, however, still feel that generative AI is useless and do not want to adopt it. 

The other concerns regarding the use of AI by the consumers include becoming too dependent on the technology (26%), and having to communicate with others using generic responses and writing, with no personality, as a result of using chatbots (24%). Some respondents were not aware of the capabilities of artificial intelligence (19%) or simply had no interest in the technology (17%). Users also cited the complexity of artificial intelligence, doubts about its usefulness, negative effects on the world, and philosophical views against artificial intelligence as reasons for not being interested in learning more about generative AI technology. 

The survey also stated that 17% of respondents use AI chatbots such as ChatGPT or Gemini several times a day, while 14% engage with them multiple times a day. 30% of respondents never used AI chatbots, while the number was just 16% in the same survey last year. 

Artificial intelligence chatbots, however, are not engaging many people regularly. 21% of respondents use them only once or several times a week, while 11% use them a few times a month, and 8% use them even less frequently. In comparison, 30% of respondents never engage with AI chatbots, which is an increase from 16% in the previous survey. 

Interestingly enough, over 42% of Future publication readers use generative AI to communicate daily, which is double the percentage of respondents who usually read the Future website or books published by Future publishers. 

There is an evident change in the attitude of the consumer towards the use of artificial intelligence in their everyday lives. While many people are adopting AI-powered technology both in the workplace and at home, it appears that the engagement of consumers with artificial intelligence is nuanced. As businesses continue to innovate, consumers are rethinking their relationships with the technology. As such, with the increasing concerns over the privacy, trust, and authenticity of artificial intelligence solutions, it is evident that the consumer will continue to engage selectively with this emerging technology.

FakeGit Malware Campaign Abuses GitHub Repositories and AI Tools

 

There has been an extensive malware campaign, dubbed FakeGit, that utilizes thousands of counterfeit GitHub repositories to distribute SmartLoader malware, which is increasingly targeted at exploiting artificial intelligence (AI) tools and Model Context Protocol (MCP) servers in order to distribute the malware. 

Researchers at Island have discovered that approximately 7,600 malicious GitHub repositories have been constructed by using approximately 6,600 false developers profiles, creating nearly 7,600 malicious GitHub repositories. 

Thousands of repositories are masquerading as AI skills or MCP servers, offering integration with services such as Google Mail, WhatsApp, Docker, Jenkins, and Databricks. It is believed that FakeGit is an evolution of a previous malware operation that was previously associated with Water Kurita and that used Lumma Stealer. 

Research by Island researchers indicates that in March 2026, the campaign began focusing on artificial intelligence-based repositories, peaking in April with hundreds of repositories impersonating artificial intelligence tools before expanding into a broader ecosystem of fake AI agents, workflows, and MCP servers. By copying code, creating convincing README files, and impersonating developer identities, the fake repositories are very closely resembling legitimate open-source projects. 

A multi-stage infection chain is triggered by the download of malicious ZIP archives. Upon activation, the attack launches a LuaJIT-based loader that launches an obfuscated Lua script to install SmartLoader. SmartLoader establishes persistence on the compromised system and launches StealC, a malicious program capable of harvesting sensitive data from infected devices once it has been activated. 

After installation, SmartLoader creates persistence using scheduled tasks, retrieves its C2 server using the Polygon blockchain smart contract, downloads encrypted payloads hosted on GitHub, and ultimately deploys the StealC information stealer by deploying the C2 server. A new advanced tactic, AgentBaiting, has also been identified, which highlights how AI-powered coding assistants and autonomous agents can unintentionally aid hackers in gaining control of a computer. 

By optimizing fake repositories, threat actors can provide users with legitimate resources instead of forcing them to visit malicious links. Research conducted by Island researchers demonstrated that Claude Code automatically replicated malicious repositories and downloaded the associated files onto a test system, resulting in the discovery and recommendation of legitimate resources by AI models searching for free AI skills or MCP servers. 

In spite of this, the AI assistant detected suspicious indicators before executing the payload, which suggests that even though AI agents can be manipulated into retrieving malicious content, they may still be capable of detecting threats later on during the execution phase. In spite of the fact that these limited tests were not intended to measure the overall detection capabilities of artificial intelligence coding assistants, Island research demonstrated that AI assistants, such as Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, could detect malicious repositories during routine searches in response to user requests. 

Through artificial intelligence-assisted discovery processes, attackers can potentially pass malicious installation instructions to users without direct human interaction. More than 14 million downloads were recorded between the 335 malicious release assets hosted in approximately 211 FakeGit repositories as a result of GitHub's public statistics. 

In analyzing this figure, researchers cautioned that it represents cumulative download requests, including automated activity, and should not be interpreted as a count of successful infections. According to security experts, FakeGit illustrates how trust in open-source ecosystems and AI-assisted software discovery can be exploited without directly compromising any platforms. 

It is more common for attackers to distribute malware through convincing branding, fictitious developer identities, and public registries. To prevent malicious code from entering development environments, organizations should verify repository publishers, evaluate AI skills and MCP servers in isolated environments before deployment, maintain approved catalogs of trusted AI plugins, and monitor AI-assisted workflows to ensure that they are not compromised. 

A number of the fake repositories were also observed to be more credible by using duplicate project descriptions, fabricating star ratings and fork counts, and impersonating legitimate developer identities, as well as impersonating legitimate developers. In this manner, malicious projects were significantly more likely to be trusted and downloaded by developers and AI-assisted coding tools. 

AI agents are increasingly involved in the discovery and deployment of software, but researchers warn that the security of these automated workflows is as important as ensuring that human users are protected from traditional social engineering attacks. Using trusted developer platforms and AI-assisted workflows, cybercriminals are adjusting to the AI era through the FakeGit campaign. 

The increasing reliance on AI tools and open-source repositories calls for verification of software sources, limiting untrusted AI integrations, and strengthening supply chain security.

Ostium Confirms $23.75 Million Vault Exploit After Off-Chain Price Feed Compromise

 

Ostium, a decentralized trading platform built on the Arbitrum blockchain, has confirmed that hackers stole $23.75 million from its liquidity provider vault after compromising the platform’s off-chain price feed infrastructure. 
 
In an update shared by the company, Ostium explained that the attackers submitted fraudulent price reports disguised as legitimate data. Using the manipulated pricing information, they quickly opened and closed oversized trading positions to generate illicit profits from the liquidity provider’s vault. 
 
The company emphasized that user collateral remained secure as it is stored in a separate smart contract that was not impacted by the attack. Existing trading positions also remain intact and have not been liquidated. 
 
Ostium allows users to trade both traditional and cryptocurrency-linked assets directly from their crypto wallets. The platform relies on external price feeds for market data, while all transactions are settled using USDC, a stablecoin pegged to the US dollar. 
 
The platform initially disclosed the security incident on July 16, announcing a temporary suspension of trading. At the time, it said that relevant authorities had been informed and that efforts were underway to monitor the movement of the stolen funds. 
 
Providing further details, Ostium said the attackers exploited vulnerabilities in the off-chain infrastructure responsible for supplying market prices to the protocol. The manipulated price feeds enabled them to siphon funds from the liquidity provider vault without affecting trader-held collateral. 
 
According to blockchain security firm PeckShieldAlert, the exploiter converted the stolen USDC into 12,080 Ethereum (ETH) before depositing 10,540 ETH into Tornado Cash, a cryptocurrency mixing service commonly used to obscure transaction trails. 
 
Ostium reiterated that leveraged trading positions are maintained in a separate smart contract, ensuring that customer collateral was not compromised. Although active long and short positions remain recorded on the platform, they are currently frozen following the suspension of trading, which occurred within an hour of the first exploit transaction. 
 
The company said it is focused on securing the compromised infrastructure and evaluating recovery options for affected liquidity providers. 
 
Five days after the breach, trading on Ostium remains suspended. The platform has stated that users will receive at least 24 hours' notice before trading resumes. Once operations restart, all existing positions will be marked to the reopening price. 
 
Ostium also confirmed that it will release a detailed post-mortem report outlining the technical aspects of the exploit in the coming days.

UK Biobank Data Breach Rekindles Debate Over Research Data Security

 

A recent case concerning the UK Biobank has once again brought up the topic of securing medical research databases, as well as the importance of keeping research data both accessible and private. Professor of Cancer Medicine at the University of Oxford David Kerr pointed out that while sharing scientific data is important, it is also essential to maintain the trust of the general public and ensure the privacy of those whose data is being used. 

UK Biobank is one of the biggest biomedical research databases in the world, established in the early 2000s. It consists of the medical information of half a million people aged between 40 and 69, who volunteered to participate in the program from 2006 to 2010. The database contains genetic, imaging, metabolic, and clinical data on each of the volunteers, making it extremely useful for research into cancer, heart disease, brain conditions, and many other illnesses. Scientists from various corners of the world can apply to use the anonymized data of the UK Biobank volunteers for research purposes. 

According to Professor Kerr, the data from the database has been used to facilitate over 18,000 scientific publications to date. The information contained in the database is anonymized, meaning that the names and other obvious personal identifiers of the donors are removed. However, their ages and sexes are still available for scientific use. The data is invaluable to scientific research, as it has been found to be instrumental in facilitating major medical breakthroughs. 

However, the controversy involving the UK Biobank occurred when three scientists who had accessed the data were accused of trying to sell a part of the database containing the information on thousands of anonymous donors through Alibaba, an international Chinese online marketplace. It is reported that both the UK and Chinese authorities managed to remove the data from the marketplace before any purchases had been made. 

As a result, the three scientists lost their access to the database, and an investigation is currently underway to determine the full extent of the breach and whether personal information has been compromised. UK Biobank has issued a formal apology, calling the security breach a serious matter and stating that they are currently reviewing their security measures. 

According to Professor Kerr, while the database contains a wealth of information that has led to unprecedented international collaboration and research opportunities, such data has to be protected at all times. He noted that with the growing importance of biomedical research, large-scale health data sets have become targets for similar breaches, which has raised multiple concerns for the general public. 

Therefore, both the UK Biobank and the wider scientific community must continue working on protecting medical data sets while allowing unrestricted international collaboration and research.

AI Agents Expose Growing Identity Security Gaps in Enterprise Environments

 

In the face of the rapid adoption of artificial intelligence agents, enterprise security is faced with an increased challenge, as organizations struggle to maintain an increasing number of non-human identities gaining access to sensitive information and critical systems. In an increasingly automated world, security experts warn that each new AI agent introduces another trusted identity into the organization. 

The use of machine identities increases an organization's attack surface without proper oversight, making it harder for security teams to maintain a complete inventory of privileged accounts and monitor their interactions with critical business systems if they are not monitored properly. As opposed to human users, AI agents, service accounts, OAuth applications, and workload identities do not follow traditional employee lifecycles. 

There are many advantages to generating them automatically, inheriting permissions, interacting across multiple systems, and often remaining active long after the applications that generated them cease to exist. In the opinion of security experts, this emerging ecosystem is leading to weaknesses in identity governance that many organizations have yet to address. According to the Non-Human Identity Management Group, machine identities outnumber human users by up to 50 to 1 in many enterprise environments. 

Some of these technologies exist only temporarily, while others continue to operate without any clear ownership for years, making it difficult to determine who created them, what resources they are allowed access to, and whether they are still necessary for security teams to monitor. During a cyber campaign conducted in 2025, threat actor UNC6395 exploited a trusted OAuth token associated with Salesloft's Drift chat integration, demonstrating the risk. 

Instead of exploiting a software vulnerability, the attackers exploited an already trustworthy machine identity in order to access AWS credentials, Snowflake tokens, and other sensitive data across Salesforce environments. The incident demonstrated how compromised machine identities can become gateways to broader enterprise cyberattacks. Security professionals emphasize that artificial intelligence itself is not creating new cybersecurity problems but rather accelerating existing ones. 

With organizations deploying AI-powered agents to automate business processes, the number of privileged identities is continuing to increase, increasing the attack surface if governance processes do not keep pace. Additionally, experts maintain that AI agents are not simply software tools but should be regarded as a distinct class of digital identity instead. 

With AI systems increasingly accessing enterprise applications, making decisions, and executing workflows independently, organizations must provide each AI agent with a unique identity, clear permissions, and full accountability in order to ensure that its actions can be monitored and audited.  

The Netwrix Data and Identity Security Report 2026 reported that organizations with significant increases in the number of identities experienced a 43% breach rate over the previous year, compared to 11% among organizations with no significant changes in their identity landscape due to artificial intelligence. There is no doubt that visibility alone is not sufficient to address the concerns of many affected organizations, as they already invested in identity governance and monitoring. 

There is also a growing concern regarding agent sprawl, in which organizations deploy artificial intelligence assistants and autonomous agents rapidly without establishing governance frameworks. As the number of machine identities within an organization increases, cybersecurity experts warn that this can cause duplicate AI agents, inconsistent permissions, and increased operational, security, and compliance risks.  

As well as stressing the importance of identifying machine identities, the report stresses the imperative of continuous identity governance which tracks ownership, permissions, lifecycles, and access rights throughout the lifespan of every AI agent and non-human identity. The accumulative nature of trusted identities can increase the likelihood that unauthorized access and misuse can occur without ongoing governance. The following four key questions should be answered continuously by organizations for every identity in their environment: What identities exist? 

Who owns them? What can they access? When should they be retired? Unless clear ownership and lifecycle management are in place, AI-driven identities may silently accumulate excessive privileges and provide an opportunity for attackers. Experts also recommend that AI agents be subject to the Zero Trust security principles. 

The same way that human users require continuous verification and least privilege access, AI agents should be given only the appropriate permissions to accomplish their duties. Keeping detailed audit logs and implementing lifecycle controls (including the capability of quickly eradicating or retiring unnecessary agents) can reduce security risks over the long term. 

A growing number of industries are adopting artificial intelligence, which requires cybersecurity strategies to evolve beyond traditional user-focused identity management strategies. It has been recommended that organizations establish stronger governance for non-human identities, identify an owner for each AI agent, and periodically review their permissions. 

A lack of such controls could result in trusted AI-powered identities becoming one of the most overlooked attack vectors in today's enterprise environments, according to experts.

Regular Website Maintenance: Why It Matters

 

A website is often the first place customers meet your brand, but many businesses treat it like a one-time project. That is a mistake. Once a site goes live, it needs regular attention to stay secure, fast, and useful. Without maintenance, even a well-designed website can begin to slow down, break in small ways, or create trust issues for visitors. Over time, outdated software, broken links, and stale content can quietly damage your online presence and make your business look inactive. 

The first major reason for regular maintenance is security. Websites are constantly exposed to threats such as outdated plugins, weak passwords, malware, and other vulnerabilities. When updates are ignored, attackers can exploit those gaps and compromise user data or site functionality. Regular patches, monitoring, and backups reduce that risk and give businesses a much stronger defense. For any company that collects leads, processes payments, or stores customer information, maintenance is a basic part of digital protection.

The second reason is performance. A website that loads slowly or behaves unpredictably can frustrate visitors within seconds. Images may become too heavy, scripts may conflict, and plugins may stop working properly after updates elsewhere in the system. Regular checks help identify these issues before they hurt conversions. A faster, smoother site also supports better engagement because users are more likely to stay, explore, and complete a form or purchase when the experience feels effortless. 

The third reason is search visibility. Search engines prefer websites that are current, technically sound, and easy to crawl. If pages contain broken links, missing metadata, outdated content, or poor mobile performance, rankings can suffer. Maintenance helps keep content fresh and signals that the site is active and relevant. That matters because search traffic is often one of the most valuable sources of visitors for businesses that want steady, long-term growth. 

Regular maintenance also improves credibility. Visitors notice when a site feels abandoned, loads slowly, or contains old information. A website should evolve with your business, your audience, and your goals. When you treat maintenance as an ongoing habit instead of an emergency fix, you protect your brand, support your marketing, and reduce expensive problems later. In short, a maintained website is not just healthier; it is more trustworthy and more effective.

Why AI Agents Are Challenging Identity Security


The wide adoption of AI agents is forcing organizations to rethink identity security as enterprises contend with an expanding population of non-human identities that increasingly outnumber employee accounts. While identity and access management programs have traditionally focused on managing people throughout their employment lifecycle, autonomous software identities are exposing governance gaps that many organizations are still struggling to address.

Unlike human users, machine identities, including AI agents, service accounts, workload identities, OAuth applications, and API credentials, are created to authenticate systems, automate processes, and enable communication between applications. As organizations embrace cloud computing, automation, and generative AI, these identities are being created at a pace that often exceeds traditional governance processes.

Human identities typically follow a predictable lifecycle. Employees are onboarded, assigned appropriate access, promoted or transferred to new roles, and eventually offboarded when they leave an organization. These lifecycle events form the foundation of identity governance, allowing security teams to periodically review permissions and revoke unnecessary access.

Machine identities operate differently. They may be generated automatically when new cloud workloads are deployed, inherit permissions from existing applications, communicate across multiple enterprise platforms, or exist only briefly before being replaced. Others remain active long after the application, automation workflow, or development project that created them has been retired. Without continuous oversight, organizations can lose visibility into who owns these identities, why they still exist, and what sensitive resources they are capable of accessing.

The scale of this challenge continues to grow. According to the Non-Human Identity Management Group, machine identities can outnumber human users by as much as 50 to one across many enterprise environments. While these identities are essential for modern business operations, security teams frequently struggle to maintain accurate inventories or establish clear ownership for every credential operating within their environments.

The security implications became evident during the UNC6395 campaign in 2025, when attackers reportedly obtained an OAuth token associated with Salesloft's Drift chat integration and leveraged the trusted credential to move across Salesforce environments used by hundreds of organizations. Rather than exploiting a software vulnerability, the attackers abused an identity that had already been authorized within enterprise systems. Investigations found that the compromised access enabled attackers to obtain additional secrets, including AWS credentials and Snowflake tokens, demonstrating how a single trusted machine identity can provide a pathway to multiple connected environments.

AI agents are not creating an entirely new category of identity risk, but they are accelerating an existing challenge. Modern AI systems increasingly perform tasks autonomously, interact with multiple business applications, retrieve sensitive information, and execute workflows without continuous human involvement. As these agents operate across cloud services, they introduce additional trusted identities, inherit permissions from existing accounts, and expand the number of credentials that organizations must secure.

This rapid growth creates a governance challenge that extends beyond simple visibility. Security teams may know that identities exist, but effective identity security also requires understanding who owns each identity, what permissions it has been granted, what sensitive data it can reach, and when that identity should no longer exist. Without continuous lifecycle management, dormant or forgotten machine identities can quietly expand an organization's attack surface.

Findings published in the 2026 Data and Identity Security Report illustrate the scale of the problem. Organizations that reported AI exponentially increasing the number of identities within their environments experienced a 43% breach rate over the previous year, compared with 11% among organizations where AI had not substantially expanded their identity footprint. Notably, many organizations affected by breaches also reported implementing stronger governance practices, suggesting that visibility alone is insufficient if identity ownership, permissions, and access reviews are not continuously maintained.

As enterprises continue integrating AI into daily operations, identity security is becoming less about managing employee accounts and more about governing a rapidly expanding ecosystem of trusted non-human identities. Maintaining comprehensive identity inventories, enforcing least-privilege access, continuously reviewing permissions, and assigning clear ownership to every human and machine identity will be essential to reducing risk. As AI agents become more autonomous, the identities organizations overlook may prove just as valuable to attackers as those they actively monitor.

Ransomware activity climbs in Q2 2026 as leading gangs consolidate attacks and AI streamlines extortion efforts

 


Ransomware groups claimed responsibility for 2,279 attacks worldwide during the second quarter of 2026, marking a 7% increase from the previous quarter and a 43% jump compared with the same period last year, according to GuidePoint Security's latest quarterly ransomware report. Researchers also recorded the highest number of active ransomware groups seen in a single quarter, reflecting an ecosystem that continues to attract new threat actors even as attacks remain concentrated among a relatively small number of established operations.

Despite the growing number of ransomware groups, a handful of operators continue to dominate victim claims. GuidePoint found that the five most active groups were collectively responsible for more than 40% of all publicly reported ransomware incidents during the quarter, suggesting that while new groups continue to emerge, only a few have achieved sustained operational scale.

Qilin remained the most active ransomware operation during Q2, accounting for approximately 13% of all recorded victim claims. It was closely followed by The Gentlemen, a comparatively new group that has expanded rapidly in recent months. Together with Akira and DragonForce, the two groups make up what GuidePoint describes as a "four-headed monster," representing the most prolific ransomware operations currently shaping the threat landscape.

Rather than relying on a single dominant ransomware syndicate, today's ransomware ecosystem is distributed across several highly active groups capable of absorbing affiliates from disrupted operations. Researchers noted that this structure could reduce the long-term impact of law enforcement takedowns, as affiliates displaced from one ransomware-as-a-service (RaaS) platform may quickly transition to another established operation without substantially disrupting attack activity.

The United States remained the country most frequently targeted by ransomware groups during the quarter, accounting for 40% of publicly claimed victims. Germany ranked second with 32%. However, GuidePoint observed a noticeable shift in targeting patterns, with the U.S. accounting for a smaller proportion of victims than in previous quarters, when roughly half of all reported incidents involved American organizations.

Researchers linked this broader geographic distribution to increased activity from groups including Qilin, The Gentlemen and LockBit, each of which claimed a larger share of victims outside the United States during Q2. The findings suggest that ransomware affiliates are expanding their operations across a wider range of regions instead of concentrating primarily on U.S.-based organizations.

Alongside changes in victim targeting, the report examined how artificial intelligence is being incorporated into ransomware operations. While concerns have grown around the possibility of AI creating entirely new forms of cyberattacks, GuidePoint found little evidence to support that scenario. Instead, threat actors are primarily using large language models (LLMs) to accelerate tasks that previously required significant manual effort, allowing them to improve efficiency without fundamentally changing their attack methods.

One case study highlighted in the report involved the data extortion group FulcrumSec. After obtaining a large volume of stolen information, the group reportedly used an LLM to examine complex databases and identify individuals appearing across multiple datasets. According to researchers, completing this level of analysis manually would have required either extensive knowledge of the victim's database architecture or a substantial investment of time by human operators.

The information extracted from the stolen data was then paired with AI-generated negotiation messages written in English. By demonstrating a detailed understanding of the compromised information, FulcrumSec strengthened its position during ransom negotiations, providing victims with evidence of the data in its possession while using those findings to justify its ransom demands.

GuidePoint also documented DragonForce's use of large language models during extortion negotiations. Researchers said the group generated convincing messages that sought to increase pressure on victims, including claims that it had legal counsel available to advise its operations. Although the report describes that assertion as almost certainly false, it illustrates how AI can help cybercriminals produce persuasive communications intended to exploit concerns around regulatory obligations, legal consequences and reputational damage.

According to the researchers, the effectiveness of these messages does not necessarily depend on their accuracy. Instead, their value lies in presenting information in a manner that appears credible enough to influence decision-making during negotiations. Large language models, which are capable of generating fluent and convincing text within seconds, are increasingly being used to support these psychological tactics.

Taken together, the findings indicate that AI is currently serving as an operational force multiplier rather than introducing an entirely new category of ransomware attacks. Tasks such as analyzing stolen data, organizing information, preparing victim communications and drafting negotiation messages can now be completed more quickly, enabling threat actors to devote more time to other stages of their operations.

At the same time, the continued concentration of attacks among a small group of highly active ransomware operations suggests that scale, organization and affiliate networks remain key drivers of today's ransomware economy. While new groups continue to enter the ecosystem, a limited number of established operators continue to account for a disproportionate share of publicly claimed attacks, reinforcing their influence across the global ransomware ecosystem.

Splunk Report Finds One in Five CISOs Pressured to Hide Cybersecurity Incidents

 

The Splunk 2026 CISO report makes public the challenges that CISOs face when trying to meet the rising demand to mask security incidents while also complying with tightening disclosure laws. According to the report, which draws its conclusions from the responses of 650 CISOs, 20% of respondents had experienced pressure from their organization not to disclose a cybersecurity incident or breach, and 53% of those who were challenged had reported an incident or breach anyway. 

It is stated that business and regulatory priorities conflict, putting CISOs in the middle of a regulatory dilemma. In addition, there is a growing sense among CISOs that they could face disciplinary or legal repercussions if they fail to protect the company from cyber ​​security threats. The percentage of CISOs concerned about being held accountable for a cyber ​​incident increased from 56% in 2025 to 78% in 2026. 

The report also shows that 79% of CISOs believe their jobs have become increasingly complex over the last year, with 43% reporting having taken on new roles and responsibilities outside their primary function, such as preventing fraud and financial crime. Moreover, 96% of CISOs responded that they are now responsible for the governance and risk management of artificial intelligence. This is yet another factor contributing to the complexity of the CISO’s work, as they must ensure that companies adopt responsible AI practices. 

The increasing difficulty of the CISO position is reflected in the fact that 26% of CISOs stated they have considered quitting their jobs due to the burdensome nature of the role. It is therefore not surprising that the report’s findings coincide with new government regulations that further tighten cybersecurity disclosure laws. For example, according to the Cyber Security and Resilience (Network and Information Systems) Bill currently under consideration in the UK Parliament, organizations in the UK will be required to report on major cyber ​​security incidents and strengthen board-level oversight of cybersecurity. 

CISOs must therefore carefully weigh the risks and benefits of any response, as reporting an incident too soon could result in financial losses for the company, whereas reporting it later could incur severe regulatory penalties. The report recommends that CISOs focus on building and maintaining strong governance by providing detailed information on how and by whom incidents were uncovered, as well as which steps had been taken to investigate and remediate the damage. 

This will ensure that the CISO’s decisions regarding disclosure of an incident are based on verifiable facts and figures. By analyzing all relevant data across enterprise networks, cloud, endpoints, or servers, the security leader can build a comprehensive report outlining the exact course of action taken after the breach was discovered. This will help to both satisfy regulatory authorities during an audit and assist in determining if and when a report needs to be filed. 

The report therefore highlights the fact that the role of the CISO has changed dramatically and now entails a wide range of responsibilities, requiring them to make decisions that go beyond the realm of traditional cybersecurity.

EU Mandates Driver Distraction Warning Systems in All New Vehicles Amid Privacy and Safety Debate

 

The European Union has introduced stricter vehicle safety regulations, making Advanced Driver Distraction Warning (ADDW) systems mandatory in all newly registered vehicles across member states from this week. The move is part of the European Commission’s expanded General Safety Regulation, aimed at reducing road fatalities and improving overall traffic safety.

Although Europe is considered one of the safest regions for road travel, the European Commission noted in its announcement that "the number of deaths and injuries from road accidents is still too high." To address this, the updated rules introduce several advanced safety requirements for new vehicles.

In addition to ADDW systems, the new legislation requires advanced emergency braking systems capable of detecting pedestrians and cyclists, along with improved forward visibility features. Driver distraction monitoring technology, which uses cameras to observe a driver's attention levels, will now become a standard feature in all newly registered vehicles.

These camera-based systems continuously monitor a driver's eye movements and facial expressions using sensors positioned behind the steering wheel or above the vehicle’s infotainment display. If the system determines that the driver has looked away from the road for an extended period, it issues alerts encouraging them to refocus.

Depending on the manufacturer, these alerts may include audible warnings, dashboard notifications, or the temporary disabling of features such as adaptive cruise control and other automated driving functions.

However, the mandate has sparked criticism from some quarters. The European Conservative described the Commission’s decision as the "latest annoying piece of EU overregulation," raising concerns over the lack of transparency regarding how data collected by these systems will be managed.

Current ADDW systems are designed to function in a closed-loop environment, where all information is processed locally within the vehicle without being transmitted to external servers. Despite this, concerns persist over the future handling of driver data as vehicles become increasingly connected.

Since April 2018, all newly approved passenger cars and light vans sold in the European Union have been equipped with the eCall emergency system, which automatically contacts emergency services following a serious accident. Combined with forecasts from consulting firm McKinsey that 95% of vehicles worldwide will be internet-connected by 2030, experts believe driver-monitoring information could eventually be transmitted beyond the vehicle.

Privacy concerns have already been highlighted in previous research. In 2023, Mozilla reviewed the privacy practices of 25 automotive brands and found that none met the organization's own privacy and security expectations. The report described connected vehicles as "the worst product category we have ever reviewed for privacy."

The issue has also drawn regulatory attention outside Europe. In 2024, the Texas Attorney General launched an investigation into several automobile manufacturers following allegations that they were collecting extensive driver data and selling it to third parties.

Critics argue that the European Union has yet to clearly define how information gathered by ADDW systems will be governed. They warn that such data could potentially be used in areas such as insurance pricing or legal proceedings in the future.

Beyond privacy issues, some motorists have questioned the usability of driver monitoring technology, arguing that overly sensitive systems can themselves become a source of distraction by issuing unnecessary alerts during routine driving activities.

While Euro NCAP has indicated that it aims to reduce reliance on "annoying" in-car safety features, the European Union’s latest regulations place greater emphasis on driver monitoring technologies, highlighting the ongoing debate between improving road safety and protecting driver privacy.

Sri Lanka Treasury’s USD 2.5 Million Loss Ruled Cybercrime Fraud

 

Sri Lanka’s recent finding that a USD 2.5 million Treasury loss was the result of cybercrime highlights how vulnerable government financial systems have become in the age of digital debt repayments. The case underlines that cybersecurity failures are no longer just technical glitches; they now directly translate into sovereign-level financial and reputational risks. 

In this incident, hackers infiltrated official communication channels linked to Sri Lanka’s Finance Ministry and Treasury during a foreign debt repayment to Australia. By compromising email systems in the Public Debt Management or related units, the attackers were able to alter payment instructions so that funds intended for a legitimate creditor were instead wired to accounts controlled by cybercriminals. The money formed part of a larger bilateral repayment package, but the redirected USD 2.5 million simply never reached the intended recipient, exposing serious weaknesses in verification and authorization workflows inside the ministry. 

A parliamentary oversight body, the Committee on Public Finance (COPF), was tasked with investigating the diversion and has now formally ruled it a cybercrime-driven fraud, not a technical debt default or routine accounting error. The panel’s report points to operational lapses within the ministry rather than a single rogue actor, suggesting that controls around email, payment approvals, and cross-checking beneficiary details were either inadequate or poorly enforced. Questions around possible internal collusion were raised in political debate, but COPF stressed that its mandate was limited to financial and procedural review, leaving any deeper criminal probe to law enforcement and cybersecurity agencies. 

For Sri Lanka, the stakes go beyond the immediate financial loss. The episode has unfolded in parallel with ongoing debt restructuring and negotiations with international creditors, making any hint of default or mismanagement politically sensitive. Officials have emphasized that creditors are likely to treat the incident as cyber fraud rather than a failure to honor obligations, yet the breach still damages confidence in the state’s ability to protect critical financial infrastructure. It also illustrates how attacks on public finance systems can ripple out into diplomatic relations, market perceptions, and domestic political narratives. 

The COPF report calls for stronger cybersecurity, a special audit of foreign debt repayment processes, and upgrades to public debt management systems so similar attacks can be detected and blocked early. For governments worldwide, the Sri Lankan case is a warning that protecting payment systems, official email, and inter-agency workflows is now a front-line national security issue, not a back-office IT concern. As cybercriminals increasingly target high-value sovereign transactions, robust multi-layer verification, staff training, and real-time threat monitoring must become standard practice in every finance ministry.

Unpatched Backdoor Identified in Firmware of Multiple Wi-Fi Routers


Research has discovered that several Tenda Wi-Fi routers are at risk of being compromised as a result of an undocumented authentication backdoor embedded in their firmware. An attacker can bypass the normal login process and gain administrator-level access to affected devices through this flaw, and no official security patch has been released yet. 

A US-based cybersecurity authority, CERT/CC (CERT/CC), identified the vulnerability and released it as a security advisory. According to the advisory, the backdoor is present in five firmware versions of older Tenda router models. A CVE-2026-11405 vulnerability has been assigned to this vulnerability. 

It is reported that the vulnerability is associated with the web server's login function, where a failed authentication attempt triggers a secondary verification process for passwords. Instead of validating both the username and password, firmware only checks the password value stored within the device configuration, which enables authentication to be successful regardless of the username used. 

In the case of Tenda devices, access is normally limited to administrator credentials via the web-based management interface. It has been discovered that the firmware contains an undocumented authentication mechanism that is activated upon failure of a standard login attempt. The firmware compares only a password stored in the device configuration, rather than validating both the username and password. Regardless of the username entered, administrative access is granted if the supplied password matches. 

Interestingly, researchers noted that the alternative password appears to be "rzadmin", which has previously been discovered in previous security research involving Tenda devices. However, since the authentication process does not validate the username, any username can successfully login when paired with the appropriate backdoor password. Despite the device's administrative interface, hidden functionality is not documented or disclosed. 

Upon matching the alternate password with the device configuration value, the firmware grants full administrator privileges and creates a valid management session. Because of its undocumented nature and inaccessibility through the standard administrative interface, it has been classified as an authentication backdoor by researchers. 

During previous security research involving Tenda devices, the alternate password was identified as "rzadmin", a credential that has previously surfaced. Despite the lack of clear explanations for its presence, experts believe it may have been accidentally left behind as part of a debugging or development tool. 

One of the biggest concerns is the lack of a vendor response. According to CERT/CC, they were unable to reach Tenda to coordinate a fix, resulting in the non-availability of official firmware updates for affected users. As a result, this vulnerability remains unpatched. Successful exploitation could result in router configuration changes, network settings changes, security settings being disabled, and potentially compromise other local networks. 

A security expert considers this vulnerability to be a significant risk for exposed devices due to its ability to grant administrator-level privileges without standard authentication. This firmware is affecting a variety of Tenda networking products, including routers, wireless hotspots, and other networking equipment. 
The following models have been confirmed as affected: 

  • FH1201 High Power AC1200 Dual-Band Wireless Router 
  • W15E v2.0 AC1200 Wireless Hotspot Router 
  • AC10 v1.0 AC1200 Smart Dual-Band Gigabit Router 
  • AC5 v1.0 AC1200 Smart Dual-Band Router 
  • AC6 v2.0 AC1200 Router 

There is a possibility that some of these products are older models and may already have reached end-of-life, resulting in uncertainty about future security updates. The CERT recommends that, until an official patch is available, remote web management be disabled and the router's default LAN IP address be changed to reduce exposure to automated internet scanning. 

If users have not received firmware updates for their affected devices and are unable to secure them, it may be prudent to replace the router with a supported model. Undocumented functionality embedded in networking firmware poses a number of security risks, particularly when vendors fail to provide timely security updates. 

Since there is no official patch available currently, users are advised to take immediate action to mitigate the vulnerability or to upgrade their hardware in order to reduce the risk of unauthorized access.

AI-Powered Attacker Breaches AWS Environment in 72 Hours, Highlights New Era of Rapid Cloud Extortion

 

A single threat actor leveraged artificial intelligence to execute a sophisticated cyberattack against a large Amazon Web Services (AWS) environment, completing the operation in just 72 hours before successfully extorting the targeted organization, according to new findings from cybersecurity and incident response firm Sygnia.

The research reveals that the financially motivated attacker relied on agentic AI workflows to significantly speed up multiple stages of the attack, including reconnaissance, tool creation, command generation, and adapting techniques to the victim's cloud environment.

While cybercriminals have increasingly used large language models (LLMs) to craft phishing emails, generate malware, and automate various stages of cyberattacks, Sygnia's investigation highlights a more advanced use case where AI enabled a single operator to carry out a large-scale cloud compromise typically associated with well-resourced threat groups.

The attack targeted an unnamed global enterprise operating within AWS and unfolded over approximately three days. According to Sygnia, the intrusion did not rely on a single security flaw but instead combined weaknesses across several components of the victim's cloud infrastructure.

"Conducted within an AWS environment, the intrusion did not exploit a single misconfiguration," Sygnia said. "Instead, it chained together weaknesses across application services, AWS resources, source code repositories, CI/CD pipelines, runtime components, and data stores. Simultaneously, the threat actor rapidly performed credential discovery, secrets harvesting, cloud enumeration, deployment pipeline abuse, runtime modification, database access, and operational disruption."

Researchers noted that although credential theft, cloud exploitation, and data exfiltration are common tactics in cloud-focused attacks, the speed and scale of this incident stood out. Activities that would normally take weeks were completed within just 72 hours, suggesting extensive use of AI-assisted automation.

Sygnia based its assessment on evidence including attacker-developed scripts, reporting artifacts, simultaneous activities, and the rapid execution of numerous cloud attack techniques. The company concluded that AI-assisted workflows enabled the attacker to accelerate reconnaissance, develop attack tools, structure commands, and continuously adapt to the target environment.

The attack reportedly began after the threat actor obtained an AWS access key through a vulnerability in an internet-facing application. Using that initial access, the attacker repeatedly executed multiple automated workflows to expand privileges, collect credentials, harvest secrets, and gain broader access across the cloud environment.

The campaign also involved systematic theft of sensitive information, creation of backdoors, and large-scale data exfiltration to strengthen the attacker's leverage during the extortion attempt.

"To increase pressure on the client, the threat actor performed mostly reversible impact actions as a demonstration of capability. These included denying access to S3 buckets, limiting ECS services or containers to a maximum capacity of zero, creating ACL rules to block network access, and purging SQS queues," the research stated. "While many of these actions were reversible, they served as a clear showcase of force: the actor was demonstrating that they had the ability to disrupt critical cloud services and could escalate to more destructive actions if needed."

Speaking to Dark Reading, Avi Dayan, Vice President of Incident Response at Sygnia, emphasized that while AI-generated commands may not significantly alter tactical defense strategies, they fundamentally change the pace at which defenders must respond.

"The mean time to detect (MTTD) and mean time to remediate (MTTR) must contract significantly [in cases where LLMs are involved in the attack execution process]. If an AI tool can execute a breakout or exfiltrate data in under a minute, a security team relying on human-in-the-loop triaging of SIEM alerts will always lose," he said. "Security operations must pivot toward automated, high-fidelity response playbooks [security orchestration, automation, and response, or SOAR] and AI-driven defense mechanisms just to match the adversary's tempo."

To counter increasingly automated threats, Sygnia recommends that organizations strengthen identity security, improve visibility across cloud assets, secure development environments, deploy layered security controls, and automate detection and incident response wherever possible.

The company also stressed the importance of having predefined containment procedures that can be executed immediately to prevent attackers from rapidly expanding access across interconnected cloud systems.

"Equally important is the establishment of predefined containment procedures that can be executed immediately when malicious activity is identified," the research stated. "In an environment where attackers can rapidly discover credentials, identify additional attack paths, and expand access across interconnected systems, delays in containment can have a disproportionate impact on the outcome of an incident. Organizations must therefore focus on reducing response friction and enabling rapid execution of containment actions at scale."

Helix Data Extortion Group Targets Microsoft SharePoint Using Vishing and MFA Abuse

 

Cybersecurity researchers have discovered a new data extortion group called Helix that has been targeting companies by using user credentials rather than software vulnerabilities. Helix has been employing voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to target Microsoft 365 and steal data from the company’s SharePoint service. 

According to the researchers at ReliaQuest, Helix has been attacking the company by first calling an employee and posing as their manager or another executive and tricking them into approving device code authentication and granting access to their Microsoft accounts. In some cases, the attackers used the manager’s name or changed the caller ID to disguise their location as the manager’s office. The attackers then register their own MFA Authenticator application on the victim’s account to ensure continued access to the Microsoft 365 platform even if the user changes their password. 

The intruders then proceed to conduct reconnaissance on the SharePoint servers, enumerating and downloading all the available data, including documents, before the company detects the breach. The data is then used to demand ransom from the victim organization by threatening to publish the information if the company does not pay a certain amount of cryptocurrency. In some instances, the attackers sell the data to other bad-actor groups. 

Researchers have noted that Helix’s automated SharePoint discovery has been one of the group’s most identifiable features. In one of the attacks, the attackers used automated search queries to find the SharePoint content before launching a large-scale data exfiltration campaign from the same IP address using a Python Requests user agent. ReliaQuest researchers suspect that Helix may be linked to the ShinyHunters and BlackFile data extortion groups due to the similarity in attack techniques. 

Although there is no conclusive evidence that the groups are connected, researchers have discovered similar infrastructure and tactics used by Helix and ShinyHunters. Some of the organizations that have fallen victim to Helix include Medtronic, Nissan, the National Association of Insurance Commissioners (NAIC), Kodak, Infinite Campus, and the University of Nottingham. These companies were previously targeted by the ShinyHunters group and confirmed the breach on their websites. 

In addition, ReliaQuest researchers discovered that one of the Helix’s exfiltration servers was hosted on an autonomous system previously used by the BlackFile infrastructure. Since BlackFile’s servers were shut down earlier this year, researchers suspect that Helix may have links to the BlackFile group or be an offshoot of the former group. However, other data extortion groups such as Pink and Redact may also be linked to BlackFile. 

The campaign that targets Microsoft 365 is similar to the ShinyHunters ransomware attack in several ways, including impersonating employees, targeting the Microsoft 365 platform, stealing data from SharePoint servers, and using social engineering to trick employees into giving access to the company’s network. Researchers have also discovered that Helix uses the NICENIC domain registrar, which has been used in some of the ShinyHunters attacks. 

Experts recommend that organizations disable device code authentication if possible and only allow managed devices to access the Microsoft SharePoint service. In addition, the company should monitor Microsoft 365 authentication activities and restrict all communications except those from trusted domains to protect their data from being exfiltrated by Helix or other cybercriminal groups. 

The discovery of the Helix campaign shows how cybercriminals are increasingly targeting user credentials to access sensitive information rather than exploiting software vulnerabilities.

Hidden Wi‑Fi Killers: Everyday Things Quietly Ruining Your Home Internet

 

Many everyday objects can quietly wreck your Wi‑Fi, and understanding them is the first step to a more stable home network. From kitchen gadgets to building materials, the invisible radio waves carrying your data are constantly competing with physical and electronic obstacles around you. 

One of the strangest culprits is food and water, including items like fish tanks and even our own bodies. Wi‑Fi uses radio waves that don’t travel well through water, so a large aquarium, a fridge full of liquids, or someone standing between your router and laptop can noticeably weaken the signal. In small apartments, simply shifting a water‑filled appliance or changing where people usually sit while streaming can reduce interference and improve speeds. 

Household electronics add another layer of complexity, especially devices that share similar frequencies with Wi‑Fi. Older microwave ovens, baby monitors, cordless phones, Bluetooth gadgets and even Christmas lights can create electromagnetic noise that clashes with the 2.4 GHz band many routers still use. If you experience drops in connection whenever someone heats lunch or turns on festive lighting, moving the router away from these devices or switching to a dual‑band or Wi‑Fi 6 router can help. 

The materials in your home can be just as problematic as gadgets and appliances. Thick stone or concrete walls, metal structures, mirrors, reinforced floors and dense furniture all absorb or reflect wireless signals, turning parts of your house into dead zones. Positioning your router centrally and elevated, rather than hiding it behind a television or inside a cabinet, makes it easier for the signal to travel through rooms without being blocked. 

Finally, neighbouring networks are an invisible but powerful source of interference, especially in crowded apartments. Dozens of routers broadcasting on overlapping channels can create “Wi‑Fi traffic jams” that slow everyone down, even when your own setup is optimal. Using a Wi‑Fi analyser app to find a less congested channel, upgrading to newer standards, and combining wired connections with smart router placement can turn a frustrating, glitchy connection into a much smoother online experience.