CySecurity News - Latest Information Security and Hacking Incidents

AI Models AI Systems AI technology AI tools ChatGPT China Cyber Security Open AI

Chinese Open AI Models Rival US Systems and Reshape Global Adoption

Chinese artificial intelligence models have rapidly narrowed the gap with leading US systems, reshaping the global AI landscape. Once considered followers, Chinese developers are now producing large language models that rival American counterparts in both performance and adoption. At the same time, China has taken a lead in model openness, a factor that is increasingly shaping how AI spreads worldwide.

This shift coincides with a change in strategy among major US firms. OpenAI, which initially emphasized transparency, moved toward a more closed and proprietary approach from 2022 onward. As access to US-developed models became more restricted, Chinese companies and research institutions expanded the availability of open-weight alternatives. A recent report from Stanford University’s Human-Centered AI Institute argues that AI leadership today depends not only on proprietary breakthroughs but also on reach, adoption, and the global influence of open models.

According to the report, Chinese models such as Alibaba’s Qwen family and systems from DeepSeek now perform at near state-of-the-art levels across major benchmarks. Researchers found these models to be statistically comparable to Anthropic’s Claude family and increasingly close to the most advanced offerings from OpenAI and Google. Independent indices, including LMArena and the Epoch Capabilities Index, show steady convergence rather than a clear performance divide between Chinese and US models.

Adoption trends further highlight this shift. Chinese models now dominate downstream usage on platforms such as Hugging Face, where developers share and adapt AI systems. By September 2025, Chinese fine-tuned or derivative models accounted for more than 60 percent of new releases on the platform. During the same period, Alibaba’s Qwen surpassed Meta’s Llama family to become the most downloaded large language model ecosystem, indicating strong global uptake beyond research settings.

This momentum is reinforced by a broader diffusion effect. As Meta reduces its role as a primary open-source AI provider and moves closer to a closed model, Chinese firms are filling the gap with freely available, high-performing systems. Stanford researchers note that developers in low- and middle-income countries are particularly likely to adopt Chinese models as an affordable alternative to building AI infrastructure from scratch. However, adoption is not limited to emerging markets, as US companies are also increasingly integrating Chinese open-weight models into products and workflows.

Paradoxically, US export restrictions limiting China’s access to advanced chips may have accelerated this progress. Constrained hardware access forced Chinese labs to focus on efficiency, resulting in models that deliver competitive performance with fewer resources. Researchers argue that this discipline has translated into meaningful technological gains.

Openness has played a critical role. While open-weight models do not disclose full training datasets, they offer significantly more flexibility than closed APIs. Chinese firms have begun releasing models under permissive licenses such as Apache 2.0 and MIT, allowing broad use and modification. Even companies that once favored proprietary approaches, including Baidu, have reversed course by releasing model weights.

Despite these advances, risks remain. Open-weight access does not fully resolve concerns about state influence, and many users rely on hosted services where data may fall under Chinese jurisdiction. Safety is another concern, as some evaluations suggest Chinese models may be more susceptible to jailbreaking than US counterparts.

Even with these caveats, the broader trend is clear. As performance converges and openness drives adoption, the dominance of US commercial AI providers is no longer assured. The Stanford report suggests China’s role in global AI will continue to expand, potentially reshaping access, governance, and reliance on artificial intelligence worldwide.

Former Cybersecurity Employees Involved in Ransomware Extortion Incidents Worth Millions



 

Ransomware

AI Cloud Cyber Crime Data Extortion Internet Ransomware

Former Cybersecurity Employees Involved in Ransomware Extortion Incidents Worth Millions

It is very unfortunate and shameful for the cybersecurity industry, when cybersecurity professionals themselves betray trust to launch cyberattacks against their own country. In a shocking incident, two men have admitted to working normal jobs as cybersecurity professionals during the day, while moonlighting as cyber attackers.

About accused

An ex-employee of the Israeli cybersecurity company Sygnia has pleaded guilty to federal crimes in the US for having involvement in ransomware cyberattacks aimed to extort millions of dollars from firms in the US.

The culprit, Ryan Clifford Goldberg, worked as a cyber incident response supervisor at Sygnia, and accepted that he was involved in a year-long plan of attacking business around the US.

Kevin Tyler Martin, another associate,who worked as an ex DigitalMint employee, worked as a negotiation intermediary with the threat actors, a role supposed to help ransomware targets, has also accepted involvement.

The situation is particularly disturbing because both men held positions of trust inside the sector established to fight against such threats.

Accused pled guilty to extortion charges

Both the accused have pleaded guilty to one count of conspiracy to manipulate commerce via extortion, according to federal court records. In the plea statement, they have accepted that along with a third actor (not charged and unknown), they both launched business compromises and ransom extortions over many years.

Extortion worth millions

In one incident, the actors successfully extorted over $1 million in crypto from a Florida based medical equipment firm. According to the federal court, besides their legitimate work, they deployed software ‘ALPHV BlackCat’ to extract and encode target’s data, and distributed the extortion money with the software’s developers.

According to DigitalMint, two of the people who were charged were ex-employees. After the incident, both were fired and “acted wholly outside the scope of their employment and without any authorization, knowledge or involvement from the company,” DigitalMint said in an email shared with Bloomberg.

In a recent conversation with Bloomberg, Sygnia mentioned that it was not a target of the investigation and the accused Goldberg was relieved of his duties as soon as the news became known.

A representative for Sygnia declined to speak further, and Goldberg and Martin's lawyers also declined to comment on the report.

China-linked Hackers Exploit Critical Cisco Zero-day as VPN Attacks Surge



 

VPN attack

Cisco cyber attack State Sponsored Hackers VPN attack

China-linked Hackers Exploit Critical Cisco Zero-day as VPN Attacks Surge

A China linked advanced persistent threat has been exploiting a previously unknown vulnerability in Cisco email security appliances, while a separate wave of large scale brute force attacks has targeted virtual private networks from Cisco and Palo Alto Networks, security researchers said.

Cisco said on Wednesday it had identified a threat group it tracks as UAT 9686 that has been abusing a critical zero day flaw in appliances running its AsyncOS software. The vulnerability, tracked as CVE 2025 20393, carries a maximum severity score of 10 and remains unpatched.

AsyncOS powers Cisco Secure Email Gateway and Secure Email and Web Manager products, which are used to protect organisations from spam and malware and to centrally manage email security systems. The flaw affects systems where the Spam Quarantine feature is enabled and accessible from the internet.

Under those conditions, attackers can bypass normal controls, gain root level access and run arbitrary commands on the appliance and potentially connected systems. Cisco said the activity dates back to at least late November.

According to Cisco Talos, UAT 9686 used the vulnerability to deploy multiple tools after gaining access, including the open source tunnelling utility Chisel and a custom malware family known as Aqua.

The main backdoor, AquaShell, is a lightweight Python implant that is delivered as encoded data and hidden within existing system files. It is accompanied by tools designed to erase logs and maintain persistent remote access through encrypted connections.

Talos said the group’s infrastructure and techniques overlap with known Chinese cyber espionage actors such as APT41 and UNC5174. Cisco said it has advised customers to disable internet access to the Spam Quarantine feature as a temporary measure and is working on a permanent fix.

Separately, researchers observed a sharp spike in brute force attacks against VPN services shortly after Cisco detected the email security campaign.

GreyNoise said that within a 16 hour window, more than 10,000 unique IP addresses generated about 1.7 million authentication attempts against Palo Alto Networks GlobalProtect VPNs.

The activity largely targeted organisations in the United States, Mexico and Pakistan. The following day, similar attacks shifted to Cisco VPN endpoints, with a significant rise in automated login attempts.

The campaign relied on standard SSL VPN login flows and appeared aimed at identifying weak or reused credentials. The activity stopped as abruptly as it began. GreyNoise said such short lived, high volume attacks are often used to quickly map exposed systems before defenders can respond.

The firm advised organisations to review edge device security, enforce strong passwords and enable multifactor authentication, noting that operational complexity and fear of disruption often delay such measures despite their importance.

2026 Digital Frontiers: AI Deregulation to Surveillance Surge



 

Internet Shutdowns

AI regulation Cyber Security Digital Privacy Facial Recognition Internet Shutdowns

2026 Digital Frontiers: AI Deregulation to Surveillance Surge

Digital technology is rapidly redrawing the boundaries of politics, business and daily life, and 2026 looks set to intensify that disruption—from AI-driven services and hyper-surveillance to new forms of protest organised on social platforms. Experts warn that governments and companies will find it increasingly difficult to balance innovation with safeguards for privacy and vulnerable communities as investment in AI accelerates and its social side-effects become harder to ignore.

One key battleground is regulation. Policymakers are tugged between pressures to “future-proof” oversight and demands from large technology firms to loosen restrictions that could slow development. In Europe, the European Commission is expected to ease parts of its year-old privacy and AI framework, including allowing firms to use personal data to train AI models under “legitimate interest” without seeking consent.

In the United States, President Donald Trump is considering an executive order that could pre-empt state AI laws—an approach aimed at reducing legal friction for Big Tech. The deregulatory push comes alongside rising scrutiny of AI harms, including lawsuits involving OpenAI and claims linked to mental health outcomes.

At the same time, countries are experimenting with tougher rules for children online. Australia has introduced fines of up to A$49.5 million for platforms that fail to take reasonable steps to block under-16 users, a move applied across major social networks and video services, and later extended to AI chatbots. France is also pushing for a European ban on social media for children under 15, while Britain’s Online Safety Act has introduced stringent age requirements for major platforms and pornography sites—though critics argue age checks can expand data collection and may isolate vulnerable young people from support communities.

Another frontier is civic unrest and the digital tools surrounding it. Social media helped catalyse youth-led protests in 2025, including movements that toppled governments in Nepal and Madagascar, and analysts expect Gen Z uprisings to continue in response to corruption, inequality and joblessness. Governments, meanwhile, are increasingly turning to internet shutdowns to suppress mobilisation, with recent examples cited in Tanzania, Afghanistan and Myanmar.

Beyond politics, border control is going digital. Britain plans to use AI to speed asylum decisions and deploy facial age estimation technology, alongside proposals for digital IDs for workers, while Trump has expanded surveillance tools tied to immigration enforcement. Finally, the climate cost of “AI everything” is rising: data centres powering generative AI consume vast energy and water, with Google reporting 6.1 billion gallons of water used by its data centres in 2023 and projections that US data centres could reach up to 9% of national electricity use by 2030.

Russian Threat Actors Deploy Zero-Click Exploit in High-Impact Attack on France



 

Zero Click Exploit

APT28 Cloud Data Theft cyber attack GRU Hackers Malware Chain Attack Sandworm APT44 Task Scheduler Flaw Vulnerabilities and Exploits Windows Vulnerability Zero Click Exploit

Russian Threat Actors Deploy Zero-Click Exploit in High-Impact Attack on France

The end of 2025 and global cybersecurity assessments indicated that one of the most formidable state-aligned hacking units in Russia has changed its tactics significantly. It has been widely reported that state-sponsored threat actors linked to the GRU's cyber-operations arm, widely known by various nicknames such as Sandworm, APT44, and Microsoft's Seashell Blizzard cluster, are recalibrating their approach with noticeable precision as they approach their target market.

A group that once was renowned for exploiting zero-day vulnerabilities and newly disclosed ones with high-profile and disruptive effects, the group has now shifted into a quieter, yet equally strategic approach, systematically targeting weaknesses resulting from human and network misconfigurations rather than exploits resulting from cutting-edge techniques.

The analysis published by Amazon Threat Intelligence, based on findings obtained by Amazon’s Threat Intelligence division, illustrates this shift, revealing that the cluster is increasingly concentrating on exploiting incorrectly configured network edge devices, suggesting a deliberate move away from overt zero-day or zero-n-day intrusion techniques to the use of sustained reconnaissance and exploitation of exposed infrastructure at the digital perimeter, signaling an intentional shift away from overt zero-day or n-day intrusion techniques.

An intrusion campaign that lasted only a few weeks, but was exceptionally powerful, was uncovered in early October by investigators attributed to RomCom, a Russia-connected advanced persistent threat group that has also been identified by Storm 0978, Tropical Scorpius, and UNC2596.

The ESET cybersecurity researchers found malicious files on a Russian-managed server on October 8, and they traced the availability of these malicious files back to October 3, just five days before they were discovered by the researchers.

The technical analysis revealed that both of these files exploited two previously unknown zero-day vulnerabilities, one of which affected Mozilla browsers used both in Firefox and Tor environments, while the other was targeted at a Windows operating system vulnerability.

By combining these weaknesses, it became possible for RomCom to deliver a silent backdoor to any device accessing a compromised website without the visitor interacting with them, consenting to them, or even clicking a single button.

Although attackers initially had the capability of executing arbitrary code globally on a global scale, the exposure window remained narrow even though attackers had the capability. Romain Dumont, a malware researcher for ESET, noted that while the operation was constrained by quick defensive actions, highlighting that even though the vulnerabilities were severe, they were patched within days, sharply limiting the likelihood of mass compromises occurring.

A deliberate and multilayered attack chain was used to perpetrate the intrusion in a manner that was designed for both reach and discretion. It was the first part of the campaign where a browser-level vulnerability was exploited to gain access to a target computer by invoking it, and this setup created the conditions for a secondary breach that was made possible via a critical flaw within the Windows Task Scheduler service known as CVE-2024-49039.

An insufficient ability to handle permissions enabled malicious tasks to execute without being detected by security prompts or requiring the user's consent. As a result of linking the two vulnerabilities, the attackers were able to achieve a zero-click compromise by granting complete system control when a victim loaded a booby-trapped webpage, eliminating traditional interaction-based warnings.

There is a concealed PowerShell process in the payload that connects to a remote command server, downloads malware and deploys it aggressively in rapid succession, so the infection timeline can be compressed to near on-the-spot execution as a result.

As researchers noted, the initial distribution vector of the attack is unclear, but the operational design strongly emphasized automation, persistence, and a minimal forensic footprint, which reduced visible indications of compromise and complicated the investigation of the incident afterward.

There has been a continuous coordination of Russian-aligned cyber units across geopolitical targets during the same monitoring period, with the country of Ukraine experiencing most sustained pressure during the period.

Despite the fact that Gamaredon appears to have been linked with Russia's Federal Security Service and has been tracked by several security indices such as Primitive Bear, UNC530, and Aqua Blizzard, it continues to be the most active hacker targeting Ukrainian government networks. As well as improving malware obfuscation frameworks, the group deployed a cloud-enabled file stealer called PteroBox that used legitimate services like Dropbox to extract data.

Fancy Bear, a cyber-intelligence division of the GRU reportedly responsible for APT28, expanded Operation RoundPress at the same time, refining its exploitation of cross-site scripting vulnerabilities within webmail platforms.

The attacker leveraged the zero-day vulnerability in the MDaemon Email Server (CVE-2024-11182) to exploit the penetration of Ukrainian private-sector systems using a zero-day exploit. One of the clusters linked to GRU, Sandworm, was also indexed under APT44 and has traditionally been associated with disruptive campaigns that targeted Ukrainian energy infrastructure, exploiting weaknesses in Active Directory Group Policies, which enabled it to deploy ZEROLOT, a new tool designed to destroy networks. A parallel investment in high-impact exploit development was demonstrated at RomaCom, a company operating within a broader Russian-aligned threat ecosystem.

It chained zero-day vulnerabilities across widely used software platforms, including Firefox and Windows, confirming that zero-interaction intrusion methods are gaining traction, reinforcing the trend toward zero-interaction intrusion methods. In addition to putting these operations into a global context, ESET’s intelligence reports also identified persistent activity from state-backed groups in the context of the operations.

APT actors aligned with China, such as Mustang Panda, have continued a campaign against governments and maritime transportation companies by using Korplug loaders and weaponized USB vectors, while PerplexedGoblin has deployed the NanoSlate espionage backdoor against a government network in Central Europe.

The operations of North Korea-aligned threat actors, such as Kimsuky and Konni, increased significantly in early 2025 after a temporary decline in late 2024 as they shifted their attentions from South Korean institutions to in-country diplomatic personnel. Andariel reappeared after nearly a year of being out of the game, when an industrial software provider in South Korea was breached, while DeceptiveDevelopment continued to conduct social engineering operations to spread the multi-platform WeaselStore malware.

This led to the spreading of fraudulent cryptocurrency and finance job postings, which enabled the malware to be distributed on multiple platforms. The APT-C-60 group also uploaded to VirusTotal in late February 2025 a VHDX archive containing an encrypted downloader and a malicious shortcut, which is internally called RadialAgent and uploaded through a Japan-based submission to the web security company.

ESET's leadership explained that the disclosures were only a small portion of the intelligence data gathered during that period, however they did represent a broad tactical trajectory that was reflected in the disclosures. To increase the effectiveness of their operations, threat actors have increasingly prioritized stealth, infrastructure exposure, malware modularity, and long-range intrusion campaigns that align with active geopolitical fault lines in order to increase their operational efficiency.

It remains unclear how the exploit chain is likely to impact the victims as well as the precise scope of damages caused. The identities of the victims who may have been affected remain unclear. This underscores the difficulty of uncovering campaigns that are designed for speed and opacity.

A pronounced concentration of targets has been observed across North America and Europe based on ESET's telemetry. Investigators have been able to confirm this based on ESET's telemetry. The Czech Republic, France, Germany, Poland, Spain, Italy, and the United States are among the notable clusters, and New Zealand and French Guiana have been identified as having a smaller number of dispersed cases.

There was no evidence of compromise among any of the victims tracked by ESET that had used the Tor browser even though the exploit theoretically was capable of reaching users accessing the web from privacy-hardened environments. According to Damien Schaeffer, a senior malware researcher at ESET, it may have been the configuration differences between Tor and standard Firefox, particularly the default permission settings, that disrupted the exploit's execution path, an idea that is reinforced by the target profile of the exploit.

In the period between RomCom's activities and the period after it, it seemed that its activities were focused primarily on corporate networks and commercial infrastructure, environments that tended not to use Tor, limiting the exploit's viability in those channels. The two vulnerabilities in the chain, Mozilla's CVE-2024-9680 and Windows Task Scheduler's CVE-2024-49039, were remediated and fixed since then. In the case of the attack, the payload was triggered by a permissions error in the Windows Task Scheduler service that caused it to connect to a remote command server and retrieve malicious software without generating security prompts or requiring the user to authorize the process.

This allowed the attack to execute. Infections had a consistent exposure point - loading a compromised or counterfeit website - which led to the deployment sequence running to completion within seconds. There were very few observable indicators and it was very difficult to detect an endpoint once the infection had been installed. In the middle of October, Mozilla released browser patches for Firefox and Tor, followed by a Thunderbird security update on October 10.

The vulnerability disclosure was received about 25 hours after Thunderbird's security update was released. A Microsoft security update on Windows was released on Nov. 12, which effectively ended the exploit chain, effectively severing any systemic exposure before it could be widespread.

As researchers have acknowledged, the original distribution vector used in seeding the infected URLs has yet to be identified, further raising concerns about the group's preference for automated campaigns over traceability campaigns.

It is important to note that even though the operation was ultimately limited by the rapid vendor response, cybersecurity specialists continue to emphasize the importance of routinely verifying software updates and to urge users and businesses to ensure that all necessary browser patches are applied. Additionally, industry experts are advocating a more rigorous validation of digital touchpoints, particularly in corporate environments, warning that infrastructure exposure, rather than novelty software, is increasingly becoming the weakest link in high-impact intrusion chains, which, if not removed, will lead to increased cyber-attacks.

As 2025 dawned on us, a stark reminder was in front of us that today's cyber conflict is no longer simply defined by the discovery of rare vulnerabilities, but by the strategic exploitation of overlooked ones, as well. In spite of the fact that RomCom and the broader Russia-aligned threat ecosystem have been implicated in a number of incidents, operational success has become increasingly dependent on persistence, infrastructure visibility, and abuse of trust - whether through network misconfiguration, poisoned policy mechanisms, or malware distribution without interaction.

There has been a limited amount of disruption since Mozilla and Microsoft released their patches, but there remains some uncertainty around initial link distribution, victim identification, and possible data impact, which illustrates a broader truth: even short access to powerful exploit chains can have lasting consequences that go far beyond their lifetime.

There is a growing awareness among security experts that defense must evolve at the same pace as offense, so organizations should implement layered intrusion monitoring systems, continuous endpoint behavior analyses, stricter identity policy audits, and routinely verifying the integrity of software as a replacement for updating only providing security.

A greater focus on the external digital assets, supply chains, and risks of cloud exfiltration will be critical in the year to come. As a result of the threat landscape in 2025, there is clear evidence that resilience can be built not only by applying advanced tools, but also through disciplined configuration hygiene, rapid incident transparency, and an attitude towards security that anticipates rather than reacts to compromise.

This Week in Cybersecurity: User Data Theft, AI-Driven Fraud, and System Vulnerabilities



 

zero Day vulnerability

Cisco Cyber Security Data Theft Pornhub United States zero Day vulnerability

This Week in Cybersecurity: User Data Theft, AI-Driven Fraud, and System Vulnerabilities

This week surfaced several developments that accentuate how cyber threats continue to affect individuals, corporations, and governments across the globe.

In the United States, federal records indicate that Customs and Border Protection is expanding its use of small surveillance drones, shifting from limited testing to routine deployment. These unmanned systems are expected to significantly widen the agency’s monitoring capabilities, with some operations extending beyond physical U.S. borders. At the same time, Immigration and Customs Enforcement is preparing to roll out a new cybersecurity contract that would increase digital monitoring of its workforce. This move aligns with broader government efforts to tighten internal controls amid growing concerns about leaks and internal opposition.

On the criminal front, a major data extortion case has emerged involving user records linked to PornHub, one of the world’s most visited adult platforms. A hacking group associated with a broader online collective claims to have obtained hundreds of millions of data entries tied to paid users. The stolen material reportedly includes account-linked browsing activity and email addresses. The company has stated that the data appears to originate from a third-party analytics service it previously relied on, meaning the exposed records may be several years old. While sensitive financial credentials were not reported as part of the breach, the attackers have allegedly attempted to pressure the company through extortion demands, raising concerns about how behavioral data can be weaponized even years after collection.

Geopolitical tensions also spilled into cyberspace this week. Venezuela’s state oil firm reported a cyber incident affecting its administrative systems, occurring shortly after U.S. authorities seized an oil tanker carrying Venezuelan crude. Officials in Caracas accused Washington of being behind the intrusion, framing it as part of a broader campaign targeting the country’s energy sector. Although the company said oil production continued, external reporting suggests that internal systems were temporarily disabled and shipping operations were disrupted. The U.S. government has not publicly accepted responsibility, and no independently verified technical evidence has been released.

In enterprise security, Cisco disclosed an actively exploited zero-day vulnerability affecting certain email security products used by organizations worldwide. Researchers confirmed that attackers had been abusing the flaw for weeks before public disclosure. The weakness exists within a specific email filtering feature and can allow unauthorized access under certain configurations. Cisco has not yet issued a patch but has advised customers to disable affected components as a temporary safeguard while remediation efforts continue.

Separately, two employees from cybersecurity firms admitted guilt in a ransomware operation, highlighting insider risk within the security industry itself. Court records show that the individuals used their professional expertise to carry out extortion attacks, including one case that resulted in a seven-figure ransom payment.

Together, these incidents reflect the expanding scope of cyber risk, spanning personal data privacy, national infrastructure, corporate security, and insider threats. Staying informed, verifying claims, and maintaining updated defenses remain essential in an increasingly complex digital environment.

GlassWorm Malware Returns with MacOS-focused Attack via VS Code Extensions



 

Malware Attack

GlassWorm malware Malware Attack

GlassWorm Malware Returns with MacOS-focused Attack via VS Code Extensions

A fourth wave of the GlassWorm malware campaign is targeting macOS developers through malicious extensions distributed on the OpenVSX registry and the Microsoft Visual Studio Marketplace, according to researchers at Koi Security.

The campaign involves compromised extensions designed for VS Code compatible editors. These extensions, which typically add productivity tools or language support, have been weaponised to deliver malware that steals developer credentials and cryptocurrency data.

GlassWorm was first identified in October after being hidden inside extensions using invisible Unicode characters. Once installed, the malware attempted to harvest login details for GitHub, npm and OpenVSX accounts, as well as data from cryptocurrency wallet extensions.

It also enabled remote access via VNC and allowed attackers to route traffic through infected systems using a SOCKS proxy. Despite public disclosure and additional safeguards, the malware resurfaced in early November on OpenVSX and again in early December on the VS Code marketplace.

In the latest campaign, researchers observed a shift in tactics. The new wave targets macOS systems exclusively, unlike earlier versions that focused on Windows. The malware now uses an AES 256 CBC encrypted payload embedded in compiled JavaScript within OpenVSX extensions, rather than invisible Unicode characters or compiled Rust binaries.

The identified extensions include studio velte distributor pro svelte extension, cudra production vsce prettier pro and puccin development full access catppuccin pro extension. The malicious code activates after a 15 minute delay, likely to avoid detection in automated analysis environments.

Persistence is achieved through macOS LaunchAgents, and AppleScript is used instead of PowerShell. The campaign continues to rely on a Solana blockchain based command and control mechanism, with infrastructure overlaps seen across earlier waves.

Koi Security said the malware now attempts to extract macOS Keychain passwords and checks for installed hardware wallet applications such as Ledger Live and Trezor Suite.

If found, it attempts to replace them with trojanised versions. Researchers noted that this feature is currently not functioning as intended, with the substituted wallet files appearing empty.

According to Koi Security, all other malicious capabilities remain active, including credential theft, data exfiltration and system persistence.

OpenVSX has flagged warnings for two of the identified extensions, citing unverified publishers. While download figures show more than 33,000 installs, researchers warned that such metrics are often inflated to create a false sense of legitimacy.

Developers who installed any of the affected extensions are advised to remove them immediately, reset GitHub passwords, revoke npm access tokens and check systems for compromise. Reinstalling the operating system may be necessary in cases of confirmed infection.

Fake DHL Pickup Slips Used in QR Code Phishing Scam



 

phishing

cyber attack DHL phishing campaigns phishing

Fake DHL Pickup Slips Used in QR Code Phishing Scam

Criminals are using fake DHL pickup slips to carry out a new phishing scam that targets customers during periods of high online shopping activity, according to the company.

The scam involves counterfeit versions of DHL’s familiar yellow delivery notices, which are typically left when a parcel cannot be delivered. Unlike genuine slips, the fake notices contain a QR code that prompts recipients to scan it to arrange a redelivery.

Scanning the code redirects users to a fraudulent website designed to closely resemble DHL’s official site. Victims are then asked to enter personal information, including names, addresses and bank details, which can be used for financial fraud and identity theft.

The tactic is part of a broader trend known as “quishing,” a form of phishing that relies on QR codes rather than email links. These scams are increasingly being spread through physical notices, emails, text messages and fake social media accounts.

Jens-Uwe Hogardt, a spokesperson for DHL, said such fraud attempts are becoming more sophisticated and harder to detect. He noted that official DHL communications are sent only from verified email domains such as “@dhl.com” or “@dhl.de,” and that legitimate messages do not originate from generic email services.

DHL advises customers to track parcels only through its official website or mobile app and to avoid scanning QR codes from unsolicited delivery notices.

Users who believe they have been targeted are urged to contact local police and DHL customer service, change passwords immediately and refrain from sharing personal or financial details through unknown links.

"If you suspect having received fraudulent emails, SMS or found a website or social media account that tries to pass off as DHL, we encourage you to let us know at your earliest convenience, so that we can quickly take actions to stop the fraud," DHL posted.

Authorities and companies continue to warn that vigilance is especially important during peak shopping seasons, when delivery-related scams tend to increase.

2FA Fail: Hackers Exploit Microsoft 365 to Launch Code Phishing Attacks



 

Social Engineering

AI Cyber Attacks Data Microsoft phishing Russia Scams Social Engineering

2FA Fail: Hackers Exploit Microsoft 365 to Launch Code Phishing Attacks

Two-factor authentication (2FA) has been one of the most secure ways to protect online accounts. It requires a secondary code besides a password. However, in recent times, 2FA has not been a reliable method anymore, as hackers have started exploiting it easily.

Experts advise users to use passkeys instead of 2FA these days, as they are more secure and less prone to hack attempts. Recent reports have shown that 2FA as a security method is undermined.

Russian-linked state sponsored threat actors are now abusing flaws in Microsoft’s 365. Experts from Proofpoint have noticed a surge in Microsoft 365 account takeover cyberattacks, threat actors are exploiting authentication code phishing to compromise Microsoft’s device authorization flow.

They are also launching advanced phishing campaigns that escape 2FA and hack sensitive accounts.

About the attack

The recent series of cyberattacks use device code phishing where hackers lure victims into giving their authentication codes on fake websites that look real. When the code is entered, hackers gain entry to the victim's Microsoft 365 account, escaping the safety of 2FA.

The campaigns started in early 2025. In the beginning, hackers relied primarily on code phishing. By March, they increased their tactics to exploit Oauth authentication workflows, which are largely used for signing into apps and services. The development shows how fast threat actors adapt when security experts find their tricks.

Who is the victim?

The attacks are particularly targeted against high-value sectors that include:

Universities and research institutes

Defense contractors

Energy providers

Government agencies

Telecommunication companies

By targeting these sectors, hackers increase the impact of their attacks for purposes such as disruption, espionage, and financial motives.

The impact

The surge in 2FA code attacks exposes a major gap, no security measure is foolproof. While 2FA is still far stronger than relying on passwords alone, it can be undermined if users are deceived into handing over their codes. This is not a failure of the technology itself, but of human trust and awareness.

A single compromised account can expose sensitive emails, documents, and internal systems. Users are at risk of losing their personal data, financial information, and even identity in these cases.

How to Stay Safe

Verify URLs carefully. Never enter authentication codes on unfamiliar or suspicious websites.

Use phishing-resistant authentication. Hardware security keys (like YubiKeys) or biometric logins are harder to trick.

Enable conditional access policies. Organizations can restrict logins based on location, device, or risk level.

Monitor OAuth activity. Be cautious of unexpected consent requests from apps or services.

Educate users. Awareness training is often the most effective defense against social engineering.

Apple Forces iOS 26 Upgrade Amid Active iPhone Security Threats



 

Mobile Security

Apple Apple device security Cybersecurity Threats iOS iOS Security Update iPhone Users Mobile Security

Apple Forces iOS 26 Upgrade Amid Active iPhone Security Threats

Apple has taken an unusually firm stance on software updates by effectively forcing many iPhone users to move to iOS 26, citing active security threats targeting devices in the wild. The decision marks a departure from Apple’s typical approach of offering extended security updates for older operating system versions, even after a major new release becomes available.

Until recently, it was widely expected that iOS 18.7.3 would serve as a final optional update for users unwilling or unable to upgrade to iOS 26, particularly those with newer devices such as the iPhone 11 and above. Early beta releases appeared to support this assumption, with fixes initially flagged for a broad range of devices. That position has since changed.

Apple has now restricted key security fixes to older models, including the iPhone XS, XS Max, and XR, leaving newer devices with no option other than upgrading to iOS 26 to remain protected. Apple has confirmed that the vulnerabilities addressed in the latest updates are actively being exploited. The company has acknowledged the presence of mercenary spyware operating in the wild, targeting specific individuals but carrying the potential to spread more widely over time. These threats elevate the importance of timely updates, particularly as spyware campaigns increasingly focus on mobile platforms.

The move has surprised industry observers, as iOS 18.7.3 was reportedly compatible with newer hardware and could have been released more broadly. Making the update available would likely have accelerated patch adoption across Apple’s ecosystem. Instead, Apple has chosen to draw a firm line, prioritizing rapid migration to iOS 26 over backward compatibility.

Resistance to upgrading remains significant. Analysts estimate that at least half of eligible users have not yet moved to iOS 26, citing factors such as storage limitations, unfamiliar design changes, and general update fatigue. While only a small percentage of users are believed to be running devices incompatible with iOS 26, a far larger group remains on older versions by choice. This creates a sizable population potentially exposed to known threats.

Security firms continue to warn about the risks of delayed updates. Zimperium has reported that more than half of mobile devices globally run outdated operating systems at any given time, a condition that attackers routinely exploit. In response, U.S. authorities have also issued update warnings, reinforcing the urgency of Apple’s message.

Beyond vulnerability fixes, iOS 26 introduces additional security enhancements. These include improved protections in Safari against advanced tracking techniques, safeguards against malicious wired connections similar to those highlighted by transportation security agencies, and new anti-scam features integrated into calls and messages. Collectively, these changes reflect Apple’s broader push to harden iPhones against evolving threat vectors.

With iOS 26.3 expected in the coming weeks, users who upgrade now are effectively committing to Apple’s new update cadence, which emphasizes continuous feature and security changes rather than isolated patches. Apple has also expanded its ability to deploy background security updates without user interaction, although it remains unclear when this capability will be used at scale.

Apple’s decision underscores a clear message: remaining on older software versions is no longer considered a safe or supported option. As active exploitation continues, the company appears willing to trade user convenience for faster, more comprehensive security coverage across its device ecosystem.

Taiwan Holds 210 BTC Seized from Criminals, Debates Bitcoin's Strategic Value



 

Taiwan Bitcoin

Criminal Assets Cyber Crime Government Holdings Seized Crypto Taiwan Bitcoin

Taiwan Holds 210 BTC Seized from Criminals, Debates Bitcoin's Strategic Value

Taiwan’s government said it is holding more than 210.45 bitcoin, worth about $18 million, all of which were seized during criminal investigations related to fraud, money laundering, and other financial crime. This disclosure was in response to a legislator’s demand for information on the state’s digital asset balance, exposing Taiwan as the 10th largest government holder of bitcoin in the world.

The value of the seized digital assets has amounted to nearly 1.3 billion NTD (about $41 million), including those in stablecoins and other cryptocurrencies. Taiwan’s stash of bitcoin is entirely the byproduct of law enforcement seizures, not strategic investing, and officials emphasise that these are funds gleaned from fighting cybercrime and financial misfeasance.

In addition to bitcoin, the Taiwanese government also holds considerable amounts of stablecoins like USDT and USDC, as well as over 2,400 ethereum coins and smaller amounts of other digital tokens. Officials are seeking to standardize the storage, tracking and reporting of such assets systemwide so the media can be assured of transparency and security.

The fate of the seized bitcoin remains undecided. Usually the practice is to auction the confiscated assets, and the proceeds are poured into the public coffers, but legislators have begun debating whether to categorize bitcoin as a strategic commodity. Some feel virtual assets are not just speculative commodities but could have a role in national security or financial sovereignty.

Taiwan’s central bank has reportedly agreed to conduct a more detailed study of bitcoin, including potential regulatory schemes and experiments involving confiscated funds. It seems the acquisition of a long-term strategy would require legislative and regulatory guidance, an indication of the increasing relevance of digital assets as a matter of public policy and finance.

Worldwide, over 640,000 BTC, which accounts for around 3% of all bitcoin supply, are held by governments, with the United States holding the largest amount, followed by China and the UK.Taiwan’s position highlights the expanding role of cryptocurrencies in law enforcement and national asset management.

India's RBI Opens Doors to Lateral Hiring in 2026, Signalling a Tech-First Shift in Financial Regulation



 

Technology

RBI contractual posts RBI lateral hiring RBI recruitment 2026 RBI supervision RBI technology roles Reserve Bank of India jobs Technology

India's RBI Opens Doors to Lateral Hiring in 2026, Signalling a Tech-First Shift in Financial Regulation

In a move highlighting the rapid evolution of India’s financial and digital landscape, the Reserve Bank of India (RBI) has announced a major lateral hiring initiative for 2026, inviting private-sector and specialist professionals into the central bank. This marks a strategic rethink in how India’s apex monetary authority prepares itself to regulate an economy increasingly driven by technology, data, cybersecurity challenges and cross-border capital movements.

The RBI has notified 93 contractual roles spanning supervision, information technology and infrastructure management. It is one of the most ambitious lateral recruitment efforts undertaken by the central bank in recent years, aimed at embedding specialised expertise directly within its core regulatory and operational functions.

A Central Bank Adapting to New Realities

Traditionally, the RBI has relied on a cadre-based structure, with talent largely sourced through internal promotions and competitive examinations. However, as the financial system becomes more digital, interconnected and complex, this model is being tested. The 2026 recruitment notification issued by the Reserve Bank of India Services Board reflects a growing recognition that modern regulation requires skills that conventional bureaucratic pathways may struggle to supply.

Emerging risks linked to cybersecurity, algorithm-based trading, artificial intelligence, advanced data analytics and sophisticated risk modelling have expanded the RBI’s responsibilities well beyond classical monetary policy. Addressing these challenges demands domain expertise that is often cultivated outside government systems.

Applications for these roles opened on December 17, 2025, and will close on January 6, 2026. Candidates will be shortlisted and interviewed, with no written examination — another clear break from long-standing recruitment practices.

A significant portion of the vacancies sit within the Department of Supervision, the RBI’s key arm for overseeing banks, non-banking financial companies and systemic risks. Roles covering credit risk, market and liquidity risk, operational risk and data analytics underline how supervision today depends heavily on interpreting complex datasets alongside enforcing regulations.

Positions such as cybersecurity analysts, data scientists, risk specialists and senior bank examiners signal a shift towards early risk detection rather than reactive crisis management. This analytics-led approach aligns with global regulatory trends, particularly as central banks worldwide respond to fintech growth and shadow banking challenges.

Technology and Data Take Centre Stage

The recruitment drive also underscores the RBI’s expanding dependence on technology. Through its Department of Information Technology, the central bank is seeking professionals in data science, AI and machine learning, network management and IT security.

These roles are central to governance, not auxiliary. RBI officials have repeatedly noted that digital payments, online lending platforms and financial infrastructure are now just as critical to systemic stability as traditional banks. The focus on advanced analytics and cyber defence reflects increasing concern about vulnerabilities in digital finance, especially as India’s transaction volumes and real-time payment systems continue to scale rapidly.

By offering full-time contractual roles, the RBI appears to be prioritising flexibility — enabling it to address skill shortages quickly without long training or induction periods.

A Broader Message for Public Institutions

Beyond filling vacancies, the 2026 hiring initiative sends a wider signal across India’s regulatory ecosystem. It suggests a subtle but important shift in how elite public institutions perceive expertise — recognising that in fast-changing environments, critical knowledge may need to be sourced directly from the market.

For seasoned professionals in technology, risk management and financial analytics, this opens a rare opportunity to contribute to policymaking at the highest level. For the RBI, it represents an experiment in combining institutional continuity with external perspectives.

Whether this infusion of lateral talent will transform the central bank’s internal culture remains uncertain. However, as India’s financial system becomes more sophisticated and globally integrated, the RBI’s decision indicates a clear understanding that maintaining stability may now require capabilities developed as much outside Mint Street as within it.

IBM Issues Critical Alert Over Authentication Bypass Flaw in API Connect Platform



 

Vulnerabilities and Exploits

API connect Authentication Bypass IBM Security Vulnerabilities and Exploits

IBM Issues Critical Alert Over Authentication Bypass Flaw in API Connect Platform

IBM has warned organizations using its API Connect platform about a severe security vulnerability that could allow unauthorized individuals to access applications remotely. The company has urged customers to apply security updates immediately to reduce the risk of exploitation.

API Connect is an enterprise-level platform designed to help organizations create, manage, and secure application programming interfaces, commonly referred to as APIs. APIs act as digital connectors that allow different software systems to communicate securely. Because these interfaces often expose internal services to external applications, business partners, and developers, they play a crucial role in modern digital operations.

IBM API Connect can be deployed in multiple environments, including on-premises infrastructure, cloud-based systems, and hybrid setups. Due to this flexibility, it is widely adopted across industries such as banking, healthcare, retail, and telecommunications, where secure data exchange is essential.

The vulnerability, identified as CVE-2025-13915, has been assigned a severity score of 9.8 out of 10, placing it in the highest risk category. According to IBM, the flaw affects API Connect versions 10.0.11.0 and 10.0.8.0 through 10.0.8.5.

At the core of the issue is a weakness in the platform’s authentication mechanism. Under certain conditions, an attacker could bypass login checks entirely and gain access to exposed applications without providing valid credentials. The attack does not require advanced technical skill or interaction from a legitimate user, which increases the potential risk.

If successfully exploited, this vulnerability could allow threat actors to reach applications that rely on API Connect as a gateway, potentially exposing sensitive systems and data. Given the role of APIs in connecting backend services, such access could have serious operational and security consequences.

IBM has released updated software versions that address the flaw and has strongly recommended that administrators upgrade affected systems as soon as possible. For organizations that are unable to deploy the updates immediately, IBM has outlined temporary mitigation steps. One key recommendation is disabling the self-service sign-up feature on the Developer Portal, which can reduce exposure until a full fix is applied.

The company has also provided detailed guidance for installing the updates across different environments, including VMware, OpenShift Container Platform, and Kubernetes-based deployments.

While IBM has not confirmed active exploitation of this specific vulnerability, U.S. cybersecurity authorities have previously flagged multiple IBM-related security flaws as being abused in real-world attacks. In recent years, several IBM vulnerabilities were added to the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities, requiring federal agencies to secure affected systems under Binding Operational Directive 22-01.

Some of those previously listed flaws were later linked to ransomware activity, underscoring the importance of addressing high-severity vulnerabilities promptly.

Security experts advise organizations using API Connect to verify their software versions, apply updates without delay, and monitor systems closely for unusual behavior. As APIs continue to form the backbone of digital services, maintaining strong authentication controls remains critical to reducing cyber risk.

Why Lightweight Browsers Are the Key to Faster, More Focused Web Productivity



 

Technology

Adapt Browser browsing speed fast browsing lightweight browser productivity browser r browser distractions Technology

Why Lightweight Browsers Are the Key to Faster, More Focused Web Productivity

As modern web browsers continue to expand into multifunctional platforms, they often sacrifice speed and efficiency in the process. What was once a simple tool for accessing the internet has become a complex workspace packed with features that many users rarely need.

Excessive built-in tools, constant background activity, and scattered workflows can slow browsing performance and create friction—especially for professionals who depend on their browser as their primary work environment.

This article examines how switching to a lightweight, task-oriented browser such as Adapt Browser can help users browse faster, stay focused, and complete daily tasks more efficiently—without depending on bulky extensions or complicated settings.

For many users, the browser serves as the main gateway for research, communication, collaboration, and content creation. Despite this central role, several productivity hurdles remain common:

High CPU and memory consumption driven by background processes
Too many open tabs leading to confusion and loss of focus
Constant movement between browser tabs and external apps
Heavy reliance on extensions that reduce stability and speed

Often, these issues stem not from the websites themselves, but from how browsers handle system resources, interfaces, and workflows. This has increased interest in fast, lightweight browsers such as Adapt Browser, along with alternatives like Opera, Edge, and Vivaldi.

Step 1: Boost Speed by Minimizing Browser Overhead

One of the most effective ways to enhance browsing performance is to lower the browser’s default resource usage. Lightweight browsers are designed with fewer background services and avoid running unnecessary processes when they are not needed.

This approach delivers clear benefits, including:

Quicker page loading
Smoother tab and window switching
Reduced memory usage, especially during multitasking

By prioritizing core functionality instead of feature overload, performance-focused browsers like Adapt Browser remain responsive even during long work sessions.

Step 2: Streamline Work by Centralizing Web Tools

A major drain on productivity comes from jumping between multiple tabs, windows, and desktop applications. Bringing essential web tools into a unified browser interface helps eliminate this inefficiency.

With centralized workflows, users can:

Access frequently used web apps without opening new tabs
Keep important tools visible while researching or browsing
Reduce time lost to context switching

Adapt Browser supports this approach by keeping critical work tools easily accessible, helping users maintain focus and workflow continuity.

Step 3: Stay Focused With a Cleaner Interface

Design plays a crucial role in productivity. Crowded toolbars, frequent alerts, and visual clutter can disrupt concentration and slow progress.

A distraction-reduced interface emphasizes:

Simple, uncluttered layouts
Clear boundaries between content and controls
Fewer interruptions during focused tasks

Adapt Browser aligns with this philosophy, making it well suited for reading, writing, analysis, and other attention-intensive work.

Step 4: Manage Tasks Better With Smarter Window Layouts

Opening dozens of tabs is often a workaround for limited visibility. Instead, smarter window and view management can improve organization without sacrificing speed.

Effective browsing strategies include:

Viewing related content side-by-side
Keeping search results visible while exploring links
Avoiding repeated or duplicate browsing actions

Adapt Browser offers flexible window and view handling, allowing users to tailor their browsing setup to match their workflow.

Putting These Principles Into Practice With Adapt Browser

Adapt Browser is built around a lightweight design philosophy that prioritizes performance and task efficiency. Rather than replicating feature-heavy ecosystems, it focuses on refining essential browsing behavior and integrated workflows.

Key highlights include:

A low-resource architecture that reduces CPU and memory usage
Built-in access to commonly used web apps and tools
An interface designed to minimize distractions and tab overload

Unlike many mainstream browsers, Adapt is non-Chromium-based, giving it greater control over system resources and core browser behavior. It is also AppEsteem certified, reflecting adherence to recognized security and transparency standards for consumer software.

This makes Adapt Browser a strong option for users seeking faster browsing and a more focused experience without complex customization. More technical details and updates are available on the official Adapt Browser website.

Faster browsing and higher productivity are not determined solely by internet speed. They depend largely on how a browser manages resources, workflows, and user attention.

By reducing overhead, simplifying interfaces, and centralizing essential tools, lightweight browsers can significantly improve daily efficiency. As web-based work continues to grow, choosing a task-focused browser can help users spend less time navigating—and more time getting meaningful work done.

South Africa Warns of Cybercrime Surge Amid Festive Season



 

South Africa

Cyber Fraud Festive Scams Online fraud ransomware attacks South Africa

South Africa Warns of Cybercrime Surge Amid Festive Season

South Africa is experiencing a sudden and deeply concerning rise in cybercrime this holiday season, with consumers and businesses being warned to prepare for more aggressive attacks on digital banking, mobile applications and online services.

Surge in festive-season attacks

The law firm Cox Yeats has witnessed a significant rise in cyberattacks themed around online shopping and digital payments, criminals are leveraging fake online shops, phishing emails, malicious QR codes and AI-powered impersonation scams to trick people into handing over credentials and payment data. They are encouraged to confirm any communications, transact only in official channels, avoid public Wi‑Fi when conducting transactions and use VPNs or mobile data, and report any suspicious activity as soon as possible.

The Information Regulator logged a total of 2 374 data breach cases that were officially reported for the 2024/25 period, averaging at a high of 200 incidents a month and increasing to about 300 monthly notifications in the current financial year—a 40% increase in security breaches. No organization is immune, as recent attacks have compromised government agencies, healthcare providers, financial institutions, retailers and telecommunication providers in ransomware, data theft and extortion.

Financial and human cost

The economic impact is devastating, with the median cost of a data breach to a local business now hovering near R49 million, a sum that can lay waste to even the most well-run small or medium-sized business. South African consumers lost more than R1 billion in 2023 alone through digital banking and mobile app scams, while SABRIC reckons annual losses to cyber-attacks could be as high as R3.3 billion, accompanied by 45% rise in digital banking fraud and a 47% increase in such related financial losses.

Surveys cited by Mpahlwa show that 70% of South African consumers have fallen victim to cybercrime, compared with 50% globally, with 35% admitting to losing money in scams and 32% acknowledging that they clicked on phishing emails. The emotional strain is mounting too, with 58% of people expressing deep concern about becoming victims, a trend worsened by AI tools that make it easier for criminals to convincingly impersonate brands, colleagues and even family members.

As ransomware continues to be a highly disruptive threat, with South Africa being the second most targeted country in Africa and third globally for cyberattacks, including double extortion attacks in which stolen data is threatened with being released to the public. Organisations are being advised to harden defences and have strong cyber insurance that covers loss of money, liability, business interruption, incidents relating to ransomware, breaches involving data, and the potential for fines from regulators as the threat landscape rapidly shifts.

Amazon Links Five-Year Cloud Cyber Campaign to Russia’s Sandworm Group



 

Hacking Group

Amazon Cloud Cloud Defense Cloud Device Cyber Campaigns Cyber Security GRU Hacking Attack Hacking Group

Amazon Links Five-Year Cloud Cyber Campaign to Russia’s Sandworm Group

Amazon is talking about a hacking problem that has been going on for a long time. This problem was targeting customers who use cloud services in countries. Amazon says that a group called Sandworm, which is linked to Russias intelligence is behind this hacking. Amazons team that looks at threats found out that this hacking has been happening for five years. The hackers were looking for weaknesses in how customers set up their devices than trying to find problems with the software. They were exploiting these weaknesses to get into customer environments.

Amazon and the customers were using cloud services. The hackers were targeting these cloud-connected environments. The hacking group Sandworm is the one that Amazon says is responsible, for this activity. The people at Amazon looked at this problem in December. Amazons chief information security officer, CJ Moses said that this is a change in how some groups try to get into important systems. CJ Moses said that these groups are not trying to get in by using software that has not been updated.

Instead they are looking at devices that are connected to the cloud and are not set up correctly. These devices are how they get into the organizations they are trying to attack. CJ Moses and the people, at Amazon think that this is a way that state-sponsored actors are trying to get into critical infrastructure. The devices that are connected to the cloud are the way that these actors get into the systems they are trying to attack.

The cyberattacks were different from others. The systems that were compromised were not old or missing security updates. The people who did the attack found problems with the equipment that helps connect things, like gateways and devices that sit at the edge of networks. These devices had been set up incorrectly by the customers who used them. This equipment is usually between the networks of a company and the cloud services they use outside.

So it gave the attackers a way to get into the rest of the system without needing to find brand weaknesses or use very complicated bad software at the start. The attackers used these edge devices as a kind of bridge to get into the system. They were able to do this because the devices were not set up correctly by the customers. The cyberattacks were able to happen because of this mistake. It made it easier for the attackers to get into the system. The compromised systems, including the routing equipment and gateways were the key, to the attack.

The bad people got into the system. They were able to get important information like passwords. Then they were able to move to different cloud services and the internal system. Amazon looked at this. They think that the bad people were able to hide what they were doing by making it look like normal activity on the network. This made it harder to catch them. The bad people used passwords and normal paths, on the network so they did not trip any alarms. This meant that the security people did not notice them because they were not doing anything that seemed out of the ordinary.

The Sandworm activity was seen times over a few years with signs of it going back to at least 2021. The people behind this campaign were going after targets all around the world. They were especially interested in organizations that do important work like those that deal with critical infrastructure. Amazon found out that the people behind the Sandworm activity were really focused on energy companies, in North America and Europe. This shows that the Sandworm activity was a thoughtful and planned operation and that is what makes it so serious the Sandworm activity is a big deal.

Security specialists looked at the results. They think this is part of a bigger pattern with advanced threat actors. What is happening is that people are taking advantage of mistakes in how thingsre set up rather than looking for things that need to be updated. As organizations start to use hybrid and cloud-based systems this is becoming a bigger problem. Even people who are very good at IT can miss mistakes in how thingsre set up and this can leave them open, to attacks all the time. Security specialists and these advanced threat actors know that they can take advantage of these mistakes without setting off the warnings that something is wrong.

Advanced threat actors are using these mistakes to get in. Amazons disclosure is a warning that having cloud security is not just about doing the usual updates. Companies that use cloud and hybrid environments for work need to do more. They need to make sure everything is set up correctly always check for problems with devices that are connected to the internet and limit who can get into the system. These things are very important, for security. Amazons cloud security is an example of this. Cloud security requires a lot of work to keep it safe.

In a separate disclosure, Amazon also acknowledged detecting attempts by North Korean operators to conduct large-scale cyber activity, though this was unrelated to the Sandworm campaign. The company later clarified that the Russian-linked operation targeted customer-managed devices hosted on AWS rather than Amazon’s own infrastructure, and that the activity represented sustained targeting over several years rather than uninterrupted access.

Antivirus vs Identity Protection Software: What to Choose and How?



 

virus

AI Antivirus Cloud Data Identity Protection phishing Technology virus

Antivirus vs Identity Protection Software: What to Choose and How?

Users often put digital security into a single category and confuse identity protection with antivirus, assuming both work the same. But they are not. Before you buy one, it is important to understand the difference between the two. This blog covers the difference between identity theft security and device security.

Cybersecurity threats: Past vs present

Traditionally, a common computer virus could crash a machine and infect a few files. That was it. But today, the cybersecurity landscape has changed from compromising computers via system overload of resources to stealing personal data.

A computer virus is a malware that self-replicates, travelling through devices. It corrupts data and software, and can also steal personal data.

With time, hackers have learned that users are easier targets than computers. These days, malware and social engineering attacks pose more threats than viruses. A well planned phishing email or a fake login page will benefit hackers more than a traditional virus.

Due to the surge in data breaches, hackers have got it easy. Your data- phone number, financial details, passwords is swimming in databases, sold like bulk goods on the dark web.

AI has made things worse and easier to exploit. Hackers can now create believable messages and even impersonate your voice. These shenanigans don't even require creativity, they need to be convincing enough to bait a victim to click or reply.

Where antivirus fails

Your personal data never stays only on your computer, it is collected and sold by data brokers and advertisers, or to third-parties who benefit from it. When threat actors get their hands on this data, they can use it to impersonate you.

In this case, antivirus is of no help. It is unable to notice breaches happening at organizations you don't control or someone impersonating you. Antivirus protects your system from malware that exists outside your system. There is a limit to what it can do. Antivirus can protect the machine, but not the user behind it.

Role of identity theft protection

Identity protection doesn't concern itself with your system health. It looks out for information that follows you everywhere- SSN, e-mail addresses, your contact number and accounts linked to your finances. If something suspicious turns up, it informs you. Identity protection works more on the monitoring side. It may watch your credit reports for threats- a new account or a hard enquiry, or falling credit score. Identity protection software looks out for early warning signs of theft, as mentioned above. It also checks if your data has been put up on dark web or part of any latest leaks.

India’s Spyware Policy Could Reshape Tech Governance Norms



 

Telecom Fraud

Android Security Data Permissions Device Surveillance DoTCyber Policy Government Spyware IMEI Verification Mobile Security Telecom Fraud

India’s Spyware Policy Could Reshape Tech Governance Norms

Several months ago, India's digital governance landscape was jolted by an unusual experiment in the control of state-controlled devices, one that briefly shifted the conversation from telecommunication networks to the mobile phones carried in consumers' pockets during the conversation.

It has been instructed that all mobile handsets intended for the Indian market be shipped with a pre-installed government-developed security application called Sanchar Saathi, which is a technology shield against the use of cell phones. This was an initiative that is being positioned by the Indian Government as a technological protection against cell phone crimes.

According to the app's promotional materials, Communication Partner (which translates to Communication Partner) was created to help users, particularly those in the mobile sector, counter mobile phone theft, financial fraud, spam, and other mobile-led scams that, as a result, have outpaced traditional police efforts.

Further, the Department of Telecommunications (DoT), the regulatory authority responsible for overseeing the mandate, stated that the application’s core functionalities could neither be disabled nor restricted by end users, effectively making the application a permanent component of the operating environment, effectively classifying it as such.

A 120-day deadline had been set for device makers to submit a detailed compliance report, including a system-level integration assessment, an audit confirmation and a detailed compliance report. It is important to note, however, that the order, which was originally defended on the basis of cybersecurity, quickly encountered a wave of public and political opposition.

Leaders of opposition, privacy advocates, and digital-rights organizations questioned the proportionality of this measure as well as the inherent risks associated with compulsory, non-removable state applications on personal devices, as well as stating that such software could be used to collect mass data, track real-time locations, and continuously profile people's behavior.

It did not take long for the Department of Transportation to retract the mandatory installation requirement after a short period of time, stating that users had already accepted the application and that mandatory pre-installation was not required. Despite the swift withdrawal, the policy failed to quell wider unrest, amplifying fears that the policy reflected a deeper intention to normalize state access to private hardware with the rhetorical background of crime prevention, rather than quell it.

Many commentators pointed out the uneasy similarities between this situation and the surveillance state described in George Orwell's 1984, where oversight is not only a default state of affairs but a matter of course. Several commentators feared that the episode was a sign that an eventual future where the individual might lose control over their personal technology to government-defined security priorities could be envisioned.

Many experts, however, believe that the controversy involves not just a single application, but rather a precedent that the application tries to set-one that raises fundamental questions about the role of technology in society, whether this is a legitimate right, and the limits of privacy of citizens in the largest democracy in the world.

Additionally, the mandate extends beyond new inventory, in that already in circulation handsets must be updated to accommodate the government application through software updates. As a result of the accompanying provisions, it is explicit that users and manufacturers cannot disable, limit, or obstruct its core functionalities.

The directive, which was conceived as a measure to strengthen cyber intelligence and combat cyber fraud, has sparked a widening discussion among security researchers, civil-rights activists, and technology policy experts over the past few months.

It has been reported that some security researchers, civil-rights advocates, and technology policy experts are warning that such state applications, which are compulsory and non-removable, will markedly alter India's approach to digital governance in a profound way, blurring longstanding boundaries between security objectives and individual control over private technology.

After abruptly reversing its policy on Wednesday, the Indian government withdrew the directive that had instructed global smartphones manufacturers such as Apple and Samsung to embed a state-developed security application into all mobile handsets sold in the country.

Several opposition lawmakers and digital-rights organizations, including those from the opposition party, reacted violently to the decision following a two-day backlash in which it was claimed that the Sanchar Saathi application, which means "Communication Partner" in Hindi, was not intended for security purposes but rather for surveillance purposes by the state.

In response to the mandate, critics from across the political aisle and privacy advocacy groups had publicly attacked the directive as an excessive intrusion into personal devices, claiming that the government was planning to "snoop on citizens through their phones."

In response to mounting criticism, the Ministry of Communications issued a statement Wednesday afternoon confirming that the government had decided not to impose mandatory pre-installation, clarifying that manufacturers would no longer be bound by the order. As it was first circulated confidentially to device makers late last month, the original directive came into public discussion only after it was leaked to domestic media on Monday.

According to the order, new handsets were required to comply with the requirement within 90 days of its release, and previously sold devices were also required to comply via software updates. This order was explicitly stating that key functions of the app cannot be disabled or restricted in order for them to be compliant with the rules.

Despite the fact that the ministry had positioned the policy in a way that was supposed to protect the nation's digital security, its quiet withdrawal signifies a rare moment in which external scrutiny reshaped the state's digital policy calculus, emphasizing the importance of controlling personal technology, especially in the world's second largest mobile market.

When the directive was first circulated to industry stakeholders, it was positioned to provide a narrow compliance window for new devices, but set a much more stringent requirement for handsets already in use. For manufacturers to ensure that all new units, whether they were manufactured in the factory or imported into India, carried the Sanchar Saathi application by default, they were given 90 days to do so.

When the unsold devices had already been positioned in retail and distribution pipelines, companies were instructed to deliver the software retroactively through system updates to ensure that the devices were present throughout the supply chain, ensuring that they were present across supply chains. The policy, if it had been enforced, would have standardized the tool throughout one of the world’s largest mobile markets.

Over 735 million people use smartphones every day. Government officials defended the mandate as a consumer protection imperative, arguing that it was necessary to protect consumers from telecom fraud based on duplicate or cloned IMEI numbers - 14 to 17 digit identification codes for mobile phones - which are the primary authentication codes on mobile networks.

With the Sanchar Saathi platform, linked to a centralized registry, users can report missing smartphones, block stolen devices, block suspicious network access, and flag fraudulent mobile communications that have been sent.

There was also evidence that it was necessary to launch the app in the first place: according to government data, since the app was launched in January, it has been able to block more than 3.7 million lost or stolen phones, and over 30 million illicit mobile connections have been terminated, including scams involving telecom companies and identity frauds associated with the app.

Despite this, the mandate put India at odds with Apple, a company whose history is characterized by a reluctance to preload government and third party applications on its products, citing ecosystem integrity and operating system security as key concerns.

In spite of Apple's relatively small share of the India smartphone market share of 4.5%, it holds a disproportionate amount of weight in global discussions about secure device architectures. Several industry insiders have noted that Apple's internal policies prohibit the inclusion of external software before the retail sale of the product, making regulatory friction a probable outcome.

It was believed in the beginning that New Delhi would eventually sway Apple's pre-installation requirement, replacing it with optional installation prompts or software nudges which could be delivered at the operating system level, replacing mandatory pre-installation. A security researcher who spoke on condition of anonymity argued that negotiations could lead to a midpoint.

Rather than imposing a mandate, they might settle for a nudge, the researcher said, echoing broader industry assumptions that the policy would prove to be more malleable in practice than it initially appeared. Privacy advocates, however, felt that the short lifespan of the order did not diminish its significance despite the fact that its duration was relatively short.

Organizations that represent civil society have warned that non-removable, mandatory state applications - even when they present themselves as essential tools to combat fraud - may affect the normalization of a level of technical authority over individual devices that extends well beyond the prevention of telecom crimes.

A quick comparison was drawn between Russia's recent requirement that a state-backed message application be embedded into smartphones and similar software standardization efforts in Russia and Russia-aligned regulatory environments, among other examples. According to Mishi Choudhary, a lawyer specializing in technology rights, "The government removes user consent as a meaningful choice, encapsulating the core argument from digital rights groups," he said.

Prior to the order being leaked to Indian media, the Ministry of Communications, which issued it on a confidential basis, declined to publicly release the entire directive or make any substantive comments regarding privacy issues. Critics contend that this silence compounded fears by leaving behind an impression of regulatory overreach that was not tempered by clarified safeguards, but by political optics.

The episode of the cybercrime crisis continued to evoke questions about the transparency in cybersecurity policymaking, the future of digital consent, and the precedent that would be set when state security frameworks began to reach into the software layer of personal hardware in a democracy already struggling with rapid digitization and fragile public trust, even after the government announced it would not enforce pre-installation requirements anymore.

A number of technology policy analysts also issued important warnings about the mandate, arguing that the risks lay not just in the stated purpose of the application but in the level of access it may be able to command in the future.

Prasanto K. Roy, a specialist in India's digital infrastructure, who maintains a long-term study of the country's regulatory impulses, characterized the directive as an example of a larger problem: the lack of transparency about what state-mandated software might ultimately be allowed to do on the hardware of individual users.

During an interview, Roy commented on the report that while Sanchar Saathi's internal workings are still unclear to the public, the permissions it seeks indicate that it is worth exercising caution. Despite the fact that we are not sure exactly what it is doing, we can see that it is asking for a lot of permissions from the flashlight to the camera which suggests that it has the potential to access almost everything.

“That alone is problematic,” he added, reflecting a growing consensus among cybersecurity researchers that expansive access requests carry structural risks when they are connected to applications that aren’t subject to independent audits or external oversight, even when explained as security prerequisites.

According to the Google Play Store's declaration, the application does not collect nor share user data, a statement which the government cited in its initial defense of the policy. The government, however, has limited its public communication around the order itself, which has exacerbated questions about consent and scope.

A BBC spokesperson confirmed that the company has formally contacted the Department of Telecommunications seeking clarification on both the privacy posture of the application as well as what safeguards if any might apply to future updates and changes to the backend capabilities of the application.

Roy, in addition, highlighted the fact that the requirements for compliance tend to conflict directly with long-standing policies maintained by most global handset manufacturers, particularly Apple, which in the past has resisted embedding government or third-party applications at the point of sale, and isn't likely to do so in the future either.

The vast majority of handset manufacturers prohibit the installation of any government app or any external app before a handset is sold - except for the Chinese and Russian companies, Roy stated, adding that the Indian order effectively forbade manufacturers from deviating from long-established operating norms.

Even though Android is the most prevalent smartphone in India, Apple's market share has become a crucial part of the policy's geopolitical undertones estimated at 4.5 percent by mid-2025 which has been attributed to the policy's geopolitical undertones. Apple has not yet issued a public statement about compliance, but it has been reported that they plan not to.

Apple is planning to communicate its concerns with Delhi, according to sources cited by Reuters, while a Reuters report said the company would register its objections with the Indian government in writing. Apple was reported to not intend to comply with India's directive, and was planning on raising its concerns with the Indian government, as suggested in another Reuters report.

Even though the comparison did little to soften its reception, the Indian directive is not completely without international precedent. According to a report published by the Russian media in August 2025, all Russian mobile phones and tablets sold domestically must carry the MAX messenger application endorsed by the government, sparking a similar debate around surveillance risks and digital autonomy.

In this episode, India was placed along with a small but notable group of nations that have tightened device verification rules through a software-based approach to enforcement, rather than relying on telecom operators or network intermediaries for oversight. That parallel underscored the concerns of privacy advocates rather than eased them.

This reinforced the belief that cybersecurity policies that rely on mandatory software, broad permissions, and silent updates - without transparent guardrails risk recalibrating the balance between fraud prevention and digital sovereignty for individuals.

Indian spyware mandate's brief rise and fall will probably outlast the order itself, leaving a policy inflection point that legislators, courts, and technology companies cannot ignore for the foreseeable future. This episode illustrates one of the most important aspects of modern security the debate shifts from intention to capability once software is a regulation instrument, instead of reassurance to verification once it becomes a regulatory instrument.

The government globally faces legitimate pressure to curb digital fraud, secure device identities, and defend the telecom infrastructure. However, experts claim that trust isn't strengthened by force but by transparency, technical auditability, and clearly defined mandates anchored in law rather than ambiguity that strengthen trust.

For India, the controversy presents an opportunity not to retreat but instead to recalibrate. According to analysts, cybersecurity frameworks governing consumer devices should also contain public rule disclosures, third-party security assessments, granular consent architectures, sunset clauses for software updates from the state, and granular consent architectures.

The groups who are representing the rights of digital citizens have also urged that future antifraud tools be activated with opt-ins, data minimization standards, local processing on devices, and not silent updates to the server without notification to the user.

However, the Sanchar Saathi debate has raised larger questions for democracies that are navigating mass digitization in the future who owns the software layer on personal hardware and how far can security imperatives extend before autonomy contracts are imposed?

There is a growing consensus that the next decade of India's digital social contract will be defined by the answers, which will determine how innovation, security, and privacy coexist not just through negotiation, but through design as well.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About