Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
data security
Chinese Chinese Hackers Cyber Security Data Breaches Data Leak Data protection data security

Knownsec Data Leak Exposes Deep Cyber Links and Global Targeting Operations

 

A recent leak involving Chinese cybersecurity company Knownsec has uncovered more than 12,000 internal documents, offering an unusually detailed picture of how deeply a private firm can be intertwined with state-linked cyber activities. The incident has raised widespread concern among researchers, as the exposed files reportedly include information on internal artificial intelligence tools, sophisticated cyber capabilities, and extensive international targeting efforts. Although the materials were quickly removed after surfacing briefly on GitHub, they have already circulated across the global security community, enabling analysts to examine the scale and structure of the operations. 

The leaked data appears to illustrate connections between Knownsec and several government-aligned entities, giving researchers insight into China’s broader cyber ecosystem. According to those reviewing the documents, the files map out international targets across more than twenty countries and regions, including India, Japan, Vietnam, Indonesia, Nigeria, and the United Kingdom. Of particular concern are spreadsheets that allegedly outline attacks on around 80 foreign organizations, including critical infrastructure providers and major telecommunications companies. These insights suggest activity far more coordinated than previously understood, highlighting the growing sophistication of state-associated cyber programs. 

Among the most significant revelations is the volume of foreign data reportedly linked to prior breaches. Files attributed to the leaks include approximately 95GB of immigration information from India, 3TB of call logs taken from South Korea’s LG U Plus, and nearly 459GB of transportation records from Taiwan. Researchers also identified multiple Remote Access Trojans capable of infiltrating Windows, Linux, macOS, iOS, and Android systems. Android-based malware found in the leaked content reportedly has functionality allowing data extraction from widely used Chinese messaging applications and Telegram, further emphasizing the operational depth of the tools. 

The documents also reference hardware-based hacking devices, including a malicious power bank engineered to clandestinely upload data into a victim’s system once connected. Such devices demonstrate that offensive cyber operations may extend beyond software to include physical infiltration tools designed for discreet, targeted attacks. Security analysts reviewing the information suggest that these capabilities indicate a more expansive and organized program than earlier assessments had captured. 

Beijing has denied awareness of any breach involving Knownsec. A Foreign Ministry spokesperson reiterated that China opposes malicious cyber activities and enforces relevant laws, though the official statement did not directly address the alleged connections between the state and companies involved in intelligence-oriented work. While the government’s response distances itself from the incident, analysts note that the leaked documents will likely renew debates about the role of private firms in national cyber strategies. 

Experts warn that traditional cybersecurity measures—including antivirus software and firewall defenses—are insufficient against the type of advanced tools referenced in the leak. Instead, organizations are encouraged to adopt more comprehensive protection strategies, such as real-time monitoring systems, strict network segmentation, and the responsible integration of AI-driven threat detection. 

The Knownsec incident underscores that as adversaries continue to refine their methods, defensive systems must evolve accordingly to prevent large-scale breaches and safeguard sensitive data.
Read more »
Token Farming Attack
Automated Attacks Cyber Security Dependency Threats malware NPM malware Open Source Risks Registry Abuse Research Software Integrity supply chain security Token Farming Attack

$116 Million at Risk as Balancer Suffers Major Smart Contract Breach

 

Security experts are becoming increasingly concerned about a developing anomaly in the JavaScript ecosystem after researchers discovered a massive cluster of self-replicating npm packages that seem to have no technical function but instead indicate a well-thought-out and financially motivated scheme. Over 43,000 of these packages—roughly 1% of the whole npm repository—were covertly uploaded over a two-year period using at least 11 synchronized accounts, according to recent research by Endor Labs. 

The libraries automatically reproduce themselves when downloaded and executed, filling the ecosystem with nearly identical code, even though they do not behave like traditional malware—showing no indicators of data theft, backdoor deployment, or system compromise. Investigators caution that even while these packages are harmless at the moment, their size and consistent behavior could serve as a channel for harmful updates in the future. 

With many packages containing tea.yaml files connected to TEA cryptocurrency accounts, early indications also point to a potential monetization plan, indicating the operation may be built to farm tokens at scale. The scope and complexity of the program were exposed by more research in the weeks that followed. 

In late October, clusters of unusual npm uploads were first observed by Amazon's security experts using improved detection algorithms and AI-assisted monitoring. By November 7, hundreds of suspicious packages had been found, and by November 12, over 150,000 malicious entries had been linked to a network of coordinated developer accounts. 

What had started out as a few dubious packages swiftly grew into a huge discovery. They were all connected to the tea.xyz token-farming initiative, a decentralized protocol that uses TEA tokens for staking, incentives, and governance to reward open-source contributions. Instead of using ransomware or credential stealers, the attackers flooded the registry with self-replicating packages that were made to automatically create and publish new versions.

As unwary developers downloaded or interacted with the contaminated libraries, the perpetrators silently accumulated token rewards. Each package was connected to blockchain wallets under the attackers' control by embedded tea.yaml files, which made it possible for them to embezzle profits from lawful community activities without drawing attention to themselves. The event, according to security experts, highlights a broader structural flaw in contemporary software development, where the speed and transparency of open-source ecosystems may be readily exploited at scale. 

Amazon's results show how AI-driven automation has made it easy for attackers to send large quantities of garbage or dangerous goods in a short amount of time, according to Manoj Nair, chief innovation officer at Snyk. He emphasized that developers should use behavior-based scanning and automated dependency-health controls to identify low-download libraries, template-reused content, and abrupt spikes in mass publishing before such components enter their build pipelines, as manual review is no longer sufficient. 

In order to stop similar operations before they start, he continued, registry operators must also change by proactively spotting bulk uploads, duplicate code templates, and oddities in metadata. Suzu CEO Michael Bell shared these worries, claiming that the discovery of 150,000 self-replicating, token-farming npm packages shows why attackers frequently have significantly more leverage when they compromise the development supply chain than when they directly target production systems. 

Bell cautioned that companies need to treat build pipelines and dependency chains with the same rigor as production infrastructure because shift-left security is becoming the standard. This includes implementing automated scans, keeping accurate software bills of materials, enforcing lockfiles to pin trusted versions, and verifying package authenticity before installation. He pointed out that once malicious code enters production, defenders are already reacting to a breach rather than stopping an assault. 

The researchers discovered that by incorporating executable scripts and circular dependency chains into package.json files, the campaign took advantage of npm's installation procedures. In actuality, installing one malicious package set off a planned cascade that increased replication and tea.xyz teaRank scores by automatically installing several more.

The operation created significant risks by flooding the registry with unnecessary entries, taxing storage and bandwidth resources, and increasing the possibility of dependency confusion, even if the packages did not include ransomware or credential-stealing payloads. Many of the packages shared cloned code, had tea.yaml files connecting them to attacker-controlled blockchain wallets, and used standard naming conventions. Amazon recommended that companies assess their current npm dependencies, eliminate subpar or non-functional components, and bolster their supply-chain defenses with separated CI/CD environments and SBOM enforcement. 

The event contributes to an increasing number of software supply-chain risks that have led to the release of new guidelines by government organizations, such as CISA, with the goal of enhancing resilience throughout development pipelines. The campaign serves as a sobering reminder that supply-chain integrity can no longer be ignored as the inquiry comes to an end. The scope of this issue demonstrates how readily automation may corrupt open-source ecosystems and take advantage of community trust for commercial gain if left uncontrolled. 

Stronger verification procedures throughout development pipelines, ongoing dependency auditing, and stricter registry administration are all necessary, according to experts. In addition to reducing such risks, investing in clear information, resilient tooling, and cross-industry cooperation will support the long-term viability of the software ecosystems that contemporary businesses rely on.
Read more »
password alternatives
Compromised Passwords Cyber Security Google security Passkey Security passkeys for Google Account password alternatives

Google Password Warning Explained: Why Gmail Users Should Switch to Passkeys Now

 

Despite viral claims that Google is instructing every Gmail user to urgently change their password because of a direct breach, the reality is more nuanced. Google is indeed advising users to reset their credentials, but not due to a compromise of Gmail accounts themselves. Instead, the company is urging people to adopt stronger authentication—including passkeys—because a separate incident involving Salesforce increased the likelihood of sophisticated phishing attempts targeting Gmail users.  

The issue stems from a breach at Salesforce, where attackers linked to the ShinyHunters group (also identified as UNC6040) infiltrated systems and accessed business-related Gmail information such as contact directories, organizational details, and email metadata. Crucially, no Gmail passwords were stolen. However, the nature of the compromised data gives hackers enough context to craft highly convincing phishing and impersonation attempts. 

Google confirmed that this breach has triggered a surge in targeted phishing and vishing campaigns. Attackers are already posing as Google, IT teams, or trusted service vendors to deceive users into sharing login details. Some threat actors are even placing spoofed phone calls from 650–area-code numbers, making the fraud appear to originate from Google headquarters. According to Google’s internal data, phishing and vishing together now account for roughly 37% of all successful account takeovers, highlighting how effective social engineering continues to be for cybercriminals. 

With access to workplace information, attackers can send messages referencing real colleagues, departments, and recent interactions. This level of personal detail makes fraudulent communication significantly harder to recognize. Once users disclose credentials, attackers can easily break into accounts, bypass additional safeguards, and potentially remain undetected until major damage has been done. 

Google’s central message is simple—never share your Gmail password with anyone. Even callers who sound legitimate or claim to represent support teams should not be trusted. Cybersecurity experts emphasize that compromising an email account can grant attackers control over nearly all linked services, since most account recovery systems rely on email-based reset links. 

To reduce risk, Google continues to advocate for passkeys, which replace traditional passwords with device-based biometric authentication. Unlike passwords, passkeys cannot be phished, reused, or guessed, making them substantially more secure. Google also encourages users to enable app-based two-factor authentication instead of SMS codes, which can be intercepted or spoofed. 

Google’s guidance for users focuses on regularly updating passwords, enabling 2FA or passkeys, staying alert to suspicious messages or calls, using the Security Checkup tool, and taking immediate action if unusual account activity appears. This incident demonstrates how vulnerabilities in external partners—in this case, Salesforce—can still put millions of Gmail users at risk, even when Google’s own infrastructure remains protected. With more than 2.5 billion Gmail accounts worldwide, the platform remains a prime target, and ongoing awareness remains the strongest defense.
Read more »
smart contract exploit
Balancer Hack Blockchain Forensics Cross-Chain Attack Crypto Vulnerability Cyber Security Cybersecurity Threats DeFi Security Digital Asset Loss Liquidity Pool Breach smart contract exploit

Balancer Hit by Smart Contract Exploit, $116M Vulnerability Revealed


 

During the past three months, Balancer, the second most popular and high-profile cryptocurrency in the decentralized finance ecosystem has been subjected to a number of high-profile attacks from sweeping cross-chain exploits that have rapidly emerged to be one of the most significant cryptocurrency breaches over the past year. 

The results of early blockchain forensic analysis suggest losses of $100 million to $128 million, and the value of assets that have now been compromised across multiple networks has risen to $116 million, according to initial assessments circulated by independent researchers. In particular, @RoundtableSpace shared data with us on the X platform. In addition to disrupting the Ethereum mainnet as well as several prominent layer-2 networks, the incident also caused liquidity pools on Ethereum's mainnet to be disrupted. 

Almost immediately after the attack, Balancer's team recognized it and began a quick investigation into the attack, working closely with the leading blockchain security firms to contain the damage and determine the scope of the problem. It has sent ripples throughout the DeFi community, raising fresh concerns about the protocol's resilience as attackers continue to exploit complex multi-chain infrastructures to steal data. 

In light of the breach, investigators have since determined that it is a result of a flaw within Balancer's smart contracts, wherein a flaw in initialization allowed an unauthorized manipulator to manipulate the vault. Blockchain analysts have been able to determine that, based on early assessments, the attacker used a malicious contract to bypass safeguards intended to prevent swaps and imbalance across pools and circumvent the exchanges. 

There was a striking speed at which the exploit unfolded: taking advantage of Balancer's deeply composable architecture, in which multiple pools and contracts are often intertwined, the attacker managed to orchestrate multiple tight-knit transactions, starting with a critical Ethereum mainnet call. Through the use of incorrect authorization checks and callback handling, the intruder was able to redirect liquidity and drain assets in a matter of minutes. 

There is still a long way to go until full forensic reports from companies like PeckShield and Nansen are released, but preliminary data suggests that between $110 million and $116 million has been siphoned into a new wallet in Ethereum and other tokens. As the funds appear to be moving through mixers and cross-chain routes to obscurity their origin, their origin appears to be obscured in the new wallet. When investigators dissected Balancer V2's architecture, they discovered a fundamental flaw within the vault and liquidity pools, which led them to find out that the breach occurred as a result of a fundamental breach within the protocol. 

The Composability of Balancer's V2 design made it among the most widely used automated market makers, an attribute that in this instance accentuated the impact of the vulnerability. Upon investigation, it was found that the attacker had implemented a malicious contract that interfered with the pool initialization sequence of the platform, manipulating internal calls that govern the changing of balances and swapping permissions within the platform. 

Specifically, the validation check that is meant to enforce internal safeguards within the manageUserBalance function was flawed, which allowed the intruder to sidestep critical authorization steps and bypass the validation check. It is because of this loophole that the attacker could submit unauthorized parameters and siphon funds directly from the vault without activating the security measures Balancer believed were in place. 

It was an extremely complex operation that unfolded first on Ethereum's mainnet, where it was triggered by a series of precisely executed transactions before it spread to other networks that had been integrated with the V2 vault. According to preliminary assessments, the total losses will amount to between $110 million and $116 million, although some estimates place it at $128 million. 

This is one of the most consequential DeFi incidents in 2025. There were several liquid-staking derivatives and wrapped tokens that were stolen, including WETH, wstETH, OsETH, frxETH, rsETH, and rETH. A total of $70 million was sucked from Ethereum alone, while the Base and Sonic networks accounted for a loss of approximately $7 million, along with additional losses from smaller chains as well. 

In the cryptography records on the blockchain, it can be seen that the attacker quickly routed the proceeds into newly created wallets and then into a privacy mixer after they had been routed through bridges. The investigators stressed, however, that no private keys were compromised; the incident had only a direct impact on Balancer's smart contract logic and not any breach of user credentials, according to their findings. 

As a result of the breach, security experts have advised that users who have access to balancer V2 pools to take immediate precautions. It has been recommended by analysts that pool owners withdraw their funds from any affected pools without delay and revoke smart-contract approvals tied to Balancer addresses through platforms such as Revoke, DeBank, or Etherscan that can be accessed instantly. 

In addition to being advised to closely monitor their wallets using on-chain tools Like Dune Analytics and Etherscan to find out if any irregular activities are occurring, users should also follow the ongoing updates from auditing and security firms including PeckShield and Nansen as this investigation moves forward. As a consequence of the incident, there have already been noticeable effects in the broader DeFi market, such as Balancer's BAL token dropping by 5% to 10%, and the platform's overall value locking experiencing a sharp decline in value as liquidity providers began to withdraw their services in response to mounting uncertainty. 

As noted in industry observers, the episode emphasizes the inherent challenges that come with constructing secure and composable financial primitives. However, they also note that such setbacks often lead to crucial improvements. The Balancer team seems hopeful that they will be able to recover, strengthen their infrastructure, and emphasize the importance of being vigilant and continuously refining their skills in an environment that changes as quickly as the threats that surround it. 

Several experts have commented on the Balancer incident, emphasising that it should serve as a catalyst for enhancing security practices across the DeFi landscape as the investigation continues. Specifically, they say protocols must reevaluate assumptions regarding composability, perform more rigorous pre-deployment testing, and implement continuous audit cycles in order to minimize the likelihood of similar cascading failures occurring in the future. 

It is clear from this episode that users should be careful with the allocation of liquidity, monitor on-chain activity regularly, and exercise vigilant approval management. Although the breach has shaken confidence in the sector, it also represents an opportunity for the sector to grow, innovate responsibly, and strengthen the resilience of decentralized finance despite the disruption.
Read more »
Law
AI China Compliance Cyber Security Data Governance Law

China Announces Major Cybersecurity Law Revision to Address AI Risks

 



China has approved major changes to its Cybersecurity Law, marking its first substantial update since the framework was introduced in 2017. The revised legislation, passed by the Standing Committee of the National People’s Congress in late October 2025, is scheduled to come into effect on January 1, 2026. The new version aims to respond to emerging technological risks, refine enforcement powers, and bring greater clarity to how cybersecurity incidents must be handled within the country.

A central addition to the law is a new provision focused on artificial intelligence. This is the first time China’s cybersecurity legislation directly acknowledges AI as an area requiring state guidance. The updated text calls for protective measures around AI development, emphasising the need for ethical guidelines, safety checks, and governance mechanisms for advanced systems. At the same time, the law encourages the use of AI and similar technologies to enhance cybersecurity management. Although the amendment outlines strategic expectations, the specific rules that organisations will need to follow are anticipated to be addressed through later regulations and detailed technical standards.

The revised law also introduces stronger enforcement capabilities. Penalties for serious violations have been raised, giving regulators wider authority to impose heavier fines on both companies and individuals who fail to meet their obligations. The scope of punishable conduct has been expanded, signalling an effort to tighten accountability across China’s digital environment. In addition, the law’s extraterritorial reach has been broadened. Previously, cross-border activities were only included when they targeted critical information infrastructure inside China. The new framework allows authorities to take action against foreign activities that pose any form of network security threat, even if the incident does not involve critical infrastructure. In cases deemed particularly severe, regulators may impose sanctions that include financial restrictions or other punitive actions.

Alongside these amendments, the Cyberspace Administration of China has issued a comprehensive nationwide reporting rule called the Administrative Measures for National Cybersecurity Incident Reporting. This separate regulation will become effective on November 1, 2025. The Measures bring together different reporting requirements that were previously scattered across multiple guidelines, creating a single, consistent system for organisations responsible for operating networks or providing services through Chinese networks. The Measures appear to focus solely on incidents that occur within China, including those that affect infrastructure inside the country.

The reporting rules introduce a clear structure for categorising incidents. Events are divided into four levels based on their impact. Under the new criteria, an incident qualifies as “relatively major” if it involves a data breach affecting more than one million individuals or if it results in economic losses of over RMB 5 million. When such incidents occur, organisations must file an initial report within four hours of discovery. A more complete submission is required within seventy-two hours, followed by a final review report within thirty days after the incident is resolved.

To streamline compliance, the regulator has provided several reporting channels, including a hotline, an online portal, email, and the agency’s official WeChat account. Organisations that delay reporting, withhold information, or submit false details may face penalties. However, the Measures state that timely and transparent reporting can reduce or remove liability under the revised law.



Read more »
Windows
AI ChatGPT Cloud Cyber Security Data Windows

AI Models Trained on Incomplete Data Can't Protect Against Threats


In cybersecurity, AI is being called the future of threat finder. However, AI has its hands tied, they are only as good as their data pipeline. But this principle is not stopping at academic machine learning, as it is also applicable for cybersecurity.

AI-powered threat hunting will only be successful if the data infrastructure is strong too.

Threat hunting powered by AI, automation, or human investigation will only ever be as effective as the data infrastructure it stands on. Sometimes, security teams build AI over leaked data or without proper data care. This can create issues later. It can affect both AI and humans. Even sophisticated algorithms can't handle inconsistent or incomplete data. AI that is trained on poor data will also lead to poor results. 

The importance of unified data 

A correlated data controls the operation. It reduces noise and helps in noticing patterns that manual systems can't.

Correlating and pre-transforming the data makes it easy for LLMs and other AI tools. It also allows connected components to surface naturally. 

A same person may show up under entirely distinct names as an IAM principal in AWS, a committer in GitHub, and a document owner in Google Workspace. You only have a small portion of the truth when you look at any one of those signs. 

You have behavioral clarity when you consider them collectively. While downloading dozens of items from Google Workspace may look strange on its own, it becomes obviously malevolent if the same user also clones dozens of repositories to a personal laptop and launches a public S3 bucket minutes later.

Finding threat via correlation 

Correlations that previously took hours or were impossible become instant when data from logs, configurations, code repositories, and identification systems are all housed in one location. 

For instance, lateral movement that uses short-lived credentials that have been stolen frequently passes across multiple systems before being discovered. A hacked developer laptop might take on several IAM roles, launch new instances, and access internal databases. Endpoint logs show the local compromise, but the extent of the intrusion cannot be demonstrated without IAM and network data.


Read more »
Online Security
Cyber Security Digital Vulnerabilities Identity Theft Internet Safety Internet Security Awareness NordVPN Online Safety Online Security

NordVPN Survey Finds Most Americans Misunderstand Antivirus Protection Capabilities

 

A new survey by NordVPN, one of the world’s leading cybersecurity firms, has revealed a surprising lack of understanding among Americans about what antivirus software actually does. The study, which polled over 1,000 U.S. residents aged 18 to 74, found that while 52% use antivirus software daily, many hold serious misconceptions about its capabilities — misconceptions that could be putting their online safety at risk. 

According to the findings, more than a quarter of respondents incorrectly believe that antivirus software offers complete protection against all online threats. Others assume it can prevent identity theft, block phishing scams, or secure public Wi-Fi connections — functions that go far beyond what antivirus tools are designed to do. NordVPN’s Chief Technology Officer, Marijus Briedis, said the confusion highlights a troubling lack of cybersecurity awareness. “People tend to confuse different technologies and overestimate their capabilities,” he explained. “Some Americans don’t realize antivirus software’s main job is to detect and remove malware, not prevent identity theft or data breaches. This gap in understanding shows how much more cybersecurity education is needed.” 

The survey also found that many Americans mix up antivirus software with other digital security tools, such as firewalls, password managers, ad blockers, and VPNs. This misunderstanding can create a false sense of security, leaving users vulnerable to attacks. Even more concerning, over one-third of those surveyed reported not using any cybersecurity software at all, despite nearly half admitting their personal information had been exposed in a data breach. 

NordVPN’s research indicates that many users believe following good online habits alone is sufficient protection. While best practices like avoiding suspicious links, using strong passwords, and steering clear of phishing attempts are important, experts warn they are not enough in today’s sophisticated cyber landscape. Modern malware can infect devices without any direct user action, making layered protection essential. 

Participants in the survey expressed particular concern about the exposure of sensitive personal data, such as social security numbers and credit card details. However, the most commonly leaked information remains email addresses, phone numbers, and physical addresses — details often dismissed as harmless but frequently exploited by cybercriminals. Such data enables more personalized and convincing phishing or “smishing” attacks, which can lead to identity theft and financial fraud. 

Experts emphasize that while antivirus software remains a critical first line of defense, it cannot protect against every cyber threat. A combination of tools — including secure VPNs, multi-factor authentication, and strong, unique passwords — is necessary to ensure comprehensive protection. A VPN like NordVPN encrypts internet traffic, hides IP addresses, and shields users from tracking and surveillance, especially on unsecured public networks. Multi-factor authentication adds an additional verification layer to prevent unauthorized account access, while password managers help users create and store complex, unique passwords safely. 

The key takeaway from NordVPN’s research is clear: cybersecurity requires more than just one solution. Relying solely on antivirus software creates dangerous blind spots, especially when users misunderstand its limitations. As Briedis put it, “This behavior undoubtedly contributes to the concerning cybersecurity situation in the U.S. Education, awareness, and layered protection are the best ways to stay safe online.” 

With cyberattacks and data breaches on the rise, experts urge Americans to take a proactive approach — combining trusted software, informed digital habits, and vigilance about what personal information they share online.
Read more »
NATO security threats
Cyber Security Data Privacy Direct Secure Messaging European Cyber Security Matrix NATO NATO security threats

European Governments Turn to Matrix for Secure Sovereign Messaging Amid US Big Tech Concerns

 

A growing number of European governments are turning to Matrix, an open-source messaging architecture, as they seek greater technological sovereignty and independence from US Big Tech companies. Matrix aims to create an open communication standard that allows users to message each other regardless of the platform they use—similar to how email works across different providers. The decentralized protocol supports secure messaging, voice, and video communications while ensuring data control remains within sovereign boundaries. 

Matrix, co-founded by Matthew Hodgson in 2014 as a not-for-profit open-source initiative, has seen wide-scale adoption across Europe. The French government and the German armed forces now have hundreds of thousands of employees using Matrix-based platforms like Tchap and BwMessenger. Swiss Post has also built its own encrypted messaging system for public use, while similar deployments are underway across Sweden, the Netherlands, and the European Commission. NATO has even adopted Matrix to test secure communication alternatives under its NICE2 project. 

Hodgson, who also serves as CEO of Element—a company providing Matrix-based encrypted services to governments and organizations such as France and NATO—explained that interest in Matrix has intensified following global geopolitical developments. He said European governments now view open-source software as a strategic necessity, especially after the US imposed sanctions on the International Criminal Court (ICC) in early 2025. 

The sanctions, which impacted US tech firms supporting the ICC, prompted several European institutions to reconsider their reliance on American cloud and communication services. “We have seen first-hand that US Big Tech companies are not reliable partners,” Hodgson said. “For any country to be operationally dependent on another is a crazy risk.” He added that incidents such as the “Signalgate” scandal—where a US official accidentally shared classified information on a Signal chat—have further fueled the shift toward secure, government-controlled messaging infrastructure. 

Despite this, Europe’s stance on encryption remains complex. While advocating for sovereign encrypted messaging platforms, some governments are simultaneously supporting proposals like Chat Control, which would require platforms to scan messages before encryption. Hodgson criticized such efforts, warning they could weaken global communication security and force companies like Element to withdraw from regions that mandate surveillance. Matrix’s decentralized design offers resilience and security advantages by eliminating a single point of failure. 

Unlike centralized apps such as Signal or WhatsApp, Matrix operates as a distributed network, reducing the risk of large-scale breaches. Moreover, its interoperability means that various Matrix-based apps can communicate seamlessly—enabling, for example, secure exchanges between French and German government networks. Although early Matrix apps were considered less user-friendly, Hodgson said newer versions now rival mainstream encrypted platforms. Funding challenges have slowed development, as governments using Matrix often channel resources toward system integrators rather than the project itself. 

To address this, Matrix is now sustained by a membership model and potential grant funding. Hodgson’s long-term vision is to establish a fully peer-to-peer global communication network that operates without servers and cannot be compromised or monitored. Supported by the Dutch government, Matrix’s ongoing research into such peer-to-peer technology aims to simplify deployment further while enhancing security. 

As Europe continues to invest in secure digital infrastructure, Matrix’s open standard represents a significant step toward technological independence and privacy preservation. 

By embracing decentralized communication, European governments are asserting control over their data, reducing foreign dependence, and reshaping the future of secure messaging in an increasingly uncertain geopolitical landscape.
Read more »
User Privacy
Cyber Security Data Safety One Login UK Digital ID User Privacy

UK Digital ID Faces Security Crisis Ahead of Mandatory Rollout

 

The UK’s digital ID system, known as One Login, triggered major controversy in 2025 due to serious security vulnerabilities and privacy concerns, leading critics to liken it to the infamous Horizon scandal. 

One Login is a government-backed identity verification platform designed for access to public services and private sector uses such as employment verification and banking. Despite government assurances around its security and user benefits, public confidence plummeted amid allegations of cybersecurity failures and rushed implementation planned for November 18, 2025.

Critics, including MPs and cybersecurity experts, revealed that the system failed critical red-team penetration tests, with hackers gaining privileged access during simulated cyberattacks. Further concerns arose over development practices, with portions of the platform built by contractors in Romania on unsecured workstations without adequate security clearance. The government missed security deadlines, with full compliance expected only by March 2026—months after the mandatory rollout began.

This “rollout-at-all-costs” approach amidst unresolved security flaws has created a significant trust deficit, risking citizens’ personal data, which includes sensitive information like biometrics and identification documents. One Login collects comprehensive data, such as name, birth date, biometrics, and a selfie video for identity verification. This data is shared across government services and third parties, raising fears of surveillance, identity theft, and misuse.

The controversy draws a parallel to the Horizon IT scandal, where faulty software led to wrongful prosecutions of hundreds of subpostmasters. Opponents warn that flawed digital ID systems could cause similar large-scale harms, including wrongful exclusions and damaged reputations, undermining public trust in government IT projects.

Public opposition has grown, with petitions and polls showing more people opposing digital ID than supporting it. Civil liberties groups caution against intrusive government tracking and call for stronger safeguards, transparency, and privacy protections. The Prime Minister defends the program as a tool to simplify life and reduce identity fraud, but critics label it expensive, intrusive, and potentially dangerous.

In conclusion, the UK’s digital ID initiative stands at a critical crossroads, facing a crisis of confidence and comparisons to past government technology scandals. Robust security, oversight, and public trust are imperative to avoid a repeat of such failures and ensure the system serves citizens without compromising their privacy or rights.
Read more »
Mobile Security Threats
block scam calls call scams Caller Identity Calling Cyber Security mobile security measures Mobile Security Threats

TRAI Approves Caller Name Display Feature to Curb Spam and Fraud Calls

 

The Telecom Regulatory Authority of India (TRAI) has officially approved a long-awaited proposal from the Department of Telecommunications (DoT) to introduce a feature that will display the caller’s name by default on the receiver’s phone screen. Known as the Calling Name Presentation (CNAP) feature, this move is aimed at improving transparency in phone communications, curbing the growing menace of spam calls, and preventing fraudulent phone-based scams across the country. 

Until now, smartphone users in India have relied heavily on third-party applications such as Truecaller and Bharat Caller ID for identifying incoming calls. However, these apps often depend on user-generated databases and unverified information, which may not always be accurate. TRAI’s newly approved system will rely entirely on verified details gathered during the SIM registration process, ensuring that the name displayed is authentic and directly linked to the caller’s government-verified identity. 

According to the telecom regulator, the CNAP feature will be automatically activated for all subscribers across India, though users will retain the option to opt out by contacting their telecom service provider. TRAI explained that the feature will function as a supplementary service integrated with basic telecom offerings rather than as a standalone service. Every telecom operator will be required to maintain a Calling Name (CNAM) database, which will map subscribers’ verified names to their registered mobile numbers. 

When a call is placed, the receiving network will search this CNAM database through the Local Number Portability Database (LNPD) and retrieve the verified caller’s name in real-time. This name will then appear on the recipient’s screen, allowing users to make informed decisions about whether to answer the call. The mechanism aims to replicate the caller ID functionality offered by third-party apps, but with government-mandated accuracy and accountability. 

Before final approval, the DoT conducted pilot tests of the CNAP system across select cities using 4G and 5G networks. The trials revealed several implementation challenges, including software compatibility issues and the need for network system upgrades. As a result, the initial testing was primarily focused on packet-switched networks, which are more commonly used for mobile data transmission than circuit-switched voice networks.  

Industry analysts believe the introduction of CNAP could significantly enhance consumer trust and reshape how users interact with phone calls. By reducing reliance on unregulated third-party applications, the feature could also help improve data privacy and limit exposure to malicious data harvesting. Additionally, verified caller identification is expected to reduce incidents of spam calls, phishing attempts, and impersonation scams that have increasingly plagued Indian users in recent years.  

While TRAI has not announced an official rollout date, telecom operators have reportedly begun upgrading their systems and databases to accommodate the CNAP infrastructure. The rollout is expected to be gradual, starting with major telecom circles before expanding nationwide in the coming months. Once implemented, CNAP could become a major step forward in digital trust and consumer protection within India’s rapidly growing telecommunications ecosystem. 

By linking phone communication with verified identities, TRAI’s caller name display feature represents a significant shift toward a safer and more transparent mobile experience. It underscores the regulator’s ongoing efforts to safeguard users against fraudulent activities while promoting accountability within India’s telecom sector.
Read more »
Sensitive data
Cyber Security IoT devices IT Systems Palo Alto Networks Sensitive data

Nearly 50% of IoT Device Connections Pose Security Threats, Study Finds

 




A new security analysis has revealed that nearly half of all network communications between Internet of Things (IoT) devices and traditional IT systems come from devices that pose serious cybersecurity risks.

The report, published by cybersecurity company Palo Alto Networks, analyzed data from over 27 million connected devices across various organizations. The findings show that 48.2 percent of these IoT-to-IT connections came from devices classified as high risk, while an additional 4 percent were labeled critical risk.

These figures underline a growing concern that many organizations are struggling to secure the rapidly expanding number of IoT devices on their networks. Experts noted that a large portion of these devices operate with outdated software, weak default settings, or insecure communication protocols, making them easy targets for cybercriminals.


Why It’s a Growing Threat

IoT devices, ranging from smart security cameras and sensors to industrial control systems are often connected to the same network as computers and servers used for daily business operations. This creates a problem: once a vulnerable IoT device is compromised, attackers can move deeper into the network, access sensitive data, and disrupt normal operations.

The study emphasized that the main cause behind such widespread exposure is poor network segmentation. Many organizations still run flat networks, where IoT devices and IT systems share the same environment without proper separation. This allows a hacker who infiltrates one device to move easily between systems and cause greater harm.


How Organizations Can Reduce Risk

Security professionals recommend several key actions for both small businesses and large enterprises to strengthen their defenses:

1. Separate Networks:

Keep IoT devices isolated from core IT infrastructure through proper network segmentation. This prevents threats in one area from spreading to another.

2. Adopt Zero Trust Principles:

Follow a security model that does not automatically trust any device or user. Each access request should be verified, and only the minimum level of access should be allowed.

3. Improve Device Visibility:

Maintain an accurate inventory of all devices connected to the network, including personal or unmanaged ones. This helps identify and secure weak points before they can be exploited.

4. Keep Systems Updated:

Regularly patch and update device firmware and software. Unpatched systems often contain known vulnerabilities that attackers can easily exploit.

5. Use Strong Endpoint Protection:

Deploy Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) tools across managed IT systems, and use monitoring solutions for IoT devices that cannot run these tools directly.


As organizations rely more on connected devices to improve efficiency, the attack surface grows wider. Without proper segmentation, monitoring, and consistent updates, one weak device can become an entry point for cyberattacks that threaten entire operations.

The report reinforces an important lesson: proactive network management is the foundation of cybersecurity. Ensuring visibility, limiting trust, and continuously updating systems can significantly reduce exposure to emerging IoT-based threats.




Read more »
Data
AI APT41 Cloud Cyber Security Data

Chinese Hackers Attack Prominent U.S Organizations


Chinese cyber-espionage groups attacked U.S organizations with links to international agencies. This has now become a problem for the U.S, as state-actors from China keep attacking.  Attackers were trying to build a steady presence inside the target network.

Series of attacks against the U.S organizations 

Earlier this year, the breach was against a famous U.S non-profit working in advocacy, that demonstrated advanced techniques and shared tools among Chinese cyber criminal gangs like APT41, Space Pirates, and Kelp.

They struck again in April with various malicious prompts checking both internal network breach and internet connectivity, particularly targeting a system at 192.0.0.88. Various tactics and protocols were used, showing both determination and technical adaptability to get particular internal resources.

Attack tactics 

Following the connectivity tests, the hackers used tools like netstat for network surveillance and made an automatic task via the Windows command-line tools.

This task ran a genuine MSBuild.exe app that processed an outbound.xml file to deploy code into csc.exe and connected it to a C2 server. 

These steps hint towards automation (through scheduled tasks) and persistence via system-level privileges increasing the complexity of the compromise and potential damage.

Espionage methods 

The techniques and toolkit show traces of various Chinese espionage groups. The hackers weaponized genuine software elements. This is called DLL sideloading by abusing vetysafe.exe (a VipreAV component signed by Sunbelt Software, Inc.) to load a malicious payload called sbamres.dll.

This tactic was earlier found in campaigns lkmkedytl Earth Longzhi and Space Pirates, the former also known as APT41 subgroup.

Coincidentally, the same tactic was found in cases connected to Kelp, showing the intrusive tool-sharing tactics within Chinese APTs.

Read more »
Security Breach
AI Systems Cyber Security Google MFA Security Breach

Google Probes Weeks-Long Security Breach Linked to Contractor Access

 




Google has launched a detailed investigation into a weeks-long security breach after discovering that a contractor with legitimate system privileges had been quietly collecting internal screenshots and confidential files tied to the Play Store ecosystem. The company uncovered the activity only after it had continued for several weeks, giving the individual enough time to gather sensitive technical data before being detected.

According to verified cybersecurity reports, the contractor managed to access information that explained the internal functioning of the Play Store, Google’s global marketplace serving billions of Android users. The files reportedly included documentation describing the structure of Play Store infrastructure, the technical guardrails that screen malicious apps, and the compliance systems designed to meet international data protection laws. The exposure of such material presents serious risks, as it could help malicious actors identify weaknesses in Google’s defense systems or replicate its internal processes to deceive automated security checks.

Upon discovery of the breach, Google initiated a forensic review to determine how much information was accessed and whether it was shared externally. The company has also reported the matter to law enforcement and begun a complete reassessment of its third-party access procedures. Internal sources indicate that Google is now tightening security for all contractor accounts by expanding multi-factor authentication requirements, deploying AI-based systems to detect suspicious activities such as repeated screenshot captures, and enforcing stricter segregation of roles and privileges. Additional measures include enhanced background checks for third-party employees who handle sensitive systems, as part of a larger overhaul of Google’s contractor risk management framework.

Experts note that the incident arrives during a period of heightened regulatory attention on Google’s data protection and antitrust practices. The breach not only exposes potential security weaknesses but also raises broader concerns about insider threats, one of the most persistent and challenging issues in cybersecurity. Even companies that invest heavily in digital defenses remain vulnerable when authorized users intentionally misuse their access for personal gain or external collaboration.

The incident has also revived discussion about earlier insider threat cases at Google. In one of the most significant examples, a former software engineer was charged with stealing confidential files related to Google’s artificial intelligence systems between 2022 and 2023. Investigators revealed that he had transferred hundreds of internal documents to personal cloud accounts and even worked with external companies while still employed at Google. That case, which resulted in multiple charges of trade secret theft and economic espionage, underlined how intellectual property theft by insiders can evolve into major national security concerns.

For Google, the latest breach serves as another reminder that internal misuse, whether by employees or contractors remains a critical weak point. As the investigation continues, the company is expected to strengthen oversight across its global operations. Cybersecurity analysts emphasize that organizations managing large user platforms must combine strong technical barriers with vigilant monitoring of human behavior to prevent insider-led compromises before they escalate into large-scale risks.



Read more »
Meta
Compliance Cyber Security DSA European Union Facebook GDPR Instagram Meta

EU Accuses Meta of Breaching Digital Rules, Raises Questions on Global Tech Compliance

 




The European Commission has accused Meta Platforms, the parent company of Facebook and Instagram, of violating the European Union’s Digital Services Act (DSA) by making it unnecessarily difficult for users to report illegal online content and challenge moderation decisions.

In its preliminary findings, the Commission said both platforms lack a user-friendly “Notice and Action” system — the mechanism that allows people to flag unlawful material such as child sexual abuse content or terrorist propaganda. Regulators noted that users face multiple steps and confusing options before they can file a report. The Commission also claimed that Meta’s interface relies on “dark patterns”, which are design features that subtly discourage users from completing certain actions, such as submitting reports.

According to the Commission, Meta’s appeal process also falls short of DSA requirements. The current system allegedly prevents users from adding explanations or submitting supporting evidence when disputing a moderation decision. This, the regulator said, limits users’ ability to express why they believe a decision was unfair and weakens the overall transparency of Meta’s content moderation practices.

The European Commission’s findings are not final, and Meta has the opportunity to respond before any enforcement action is taken. If the Commission confirms these violations, it could issue a non-compliance decision, which may result in penalties of up to 6 percent of Meta’s global annual revenue. The Commission may also impose recurring fines until the company aligns its operations with EU law.

Meta, in a public statement, said it “disagrees with any suggestion” that it breached the DSA. The company stated that it has already made several updates to comply with the law, including revisions to content reporting options, appeals procedures, and data access tools.

The European Commission also raised similar concerns about TikTok, saying that both companies have limited researchers’ access to public data on their platforms. The DSA requires large online platforms to provide sufficient data access so independent researchers can analyze potential harms — for example, whether minors are exposed to illegal or harmful content. The Commission’s review concluded that the data-access tools of Facebook, Instagram, and TikTok are burdensome and leave researchers with incomplete or unreliable datasets, which hinders academic and policy research.

TikTok responded that it has provided data to almost 1,000 research teams and remains committed to transparency. However, the company noted that the DSA’s data-sharing obligations sometimes conflict with the General Data Protection Regulation (GDPR), making it difficult to comply with both laws simultaneously. TikTok urged European regulators to offer clarity on how these two frameworks should be balanced.

Beyond Europe, the investigation may strain relations with the United States. American officials have previously criticized the EU for imposing regulatory burdens on U.S.-based tech firms. U.S. FTC Chairman Andrew Ferguson recently warned companies that censoring or modifying content to satisfy foreign governments could violate U.S. law. Former President Donald Trump has also expressed opposition to EU digital rules and even threatened tariffs against countries enforcing them.

For now, the Commission’s investigation continues. If confirmed, the case could set a major precedent for how global social media companies manage user safety, transparency, and accountability under Europe’s strict online governance laws.


Read more »
data security flaws
Cloud Security Critical security flaw Customer Data Cyber Security Data protection data security data security flaws

Tata Motors Fixes Security Flaws That Exposed Sensitive Customer and Dealer Data

 

Indian automotive giant Tata Motors has addressed a series of major security vulnerabilities that exposed confidential internal data, including customer details, dealer information, and company reports. The flaws were discovered in the company’s E-Dukaan portal, an online platform used for purchasing spare parts for Tata commercial vehicles. 

According to security researcher Eaton Zveare, the exposed data included private customer information, confidential documents, and access credentials to Tata Motors’ cloud systems hosted on Amazon Web Services (AWS). Headquartered in Mumbai, Tata Motors is a key global player in the automobile industry, manufacturing passenger, commercial, and defense vehicles across 125 countries. 

Zveare revealed to TechCrunch that the E-Dukaan website’s source code contained AWS private keys that granted access to internal databases and cloud storage. These vulnerabilities exposed hundreds of thousands of invoices with sensitive customer data, including names, mailing addresses, and Permanent Account Numbers (PANs). Zveare said he avoided downloading large amounts of data “to prevent triggering alarms or causing additional costs for Tata Motors.” 

The researcher also uncovered MySQL database backups, Apache Parquet files containing private communications, and administrative credentials that allowed access to over 70 terabytes of data from Tata Motors’ FleetEdge fleet-tracking software. Further investigation revealed backdoor admin access to a Tableau analytics account that stored data on more than 8,000 users, including internal financial and performance reports, dealer scorecards, and dashboard metrics. 

Zveare added that the exposed credentials provided full administrative control, allowing anyone with access to modify or download the company’s internal data. Additionally, the vulnerabilities included API keys connected to Tata Motors’ fleet management system, Azuga, which operates the company’s test drive website. Zveare responsibly reported the flaws to Tata Motors through India’s national cybersecurity agency, CERT-In, in August 2023. 

The company acknowledged the findings in October 2023 and stated that it was addressing the AWS-related security loopholes. However, Tata Motors did not specify when all issues were fully resolved. In response to TechCrunch’s inquiry, Tata Motors confirmed that all reported vulnerabilities were fixed in 2023. 

However, the company declined to say whether it notified customers whose personal data was exposed. “We can confirm that the reported flaws and vulnerabilities were thoroughly reviewed following their identification in 2023 and were promptly and fully addressed,” said Tata Motors communications head, Sudeep Bhalla. “Our infrastructure is regularly audited by leading cybersecurity firms, and we maintain comprehensive access logs to monitor unauthorized activity. We also actively collaborate with industry experts and security researchers to strengthen our security posture.” 

The incident reveals the persistent risks of misconfigured cloud systems and exposed credentials in large enterprises. While Tata Motors acted swiftly after the report, cybersecurity experts emphasize that regular audits, strict access controls, and robust encryption are essential to prevent future breaches. 

As more automotive companies integrate digital platforms and connected systems into their operations, securing sensitive customer and dealer data remains a top priority.
Read more »
University of Bremen study
Cyber Security Dark Patterns fitness apps sharing data GDPR violation health apps data privacy University of Bremen study

Study Reveals Health Apps Secretly Sharing User Data Before Consent

 

Think your favorite health apps are safe? Think again. A new study from researchers at the University of Bremen in Germany has revealed that many popular fitness and wellness apps are quietly sharing your personal data before you even click “I agree.”

The research team analyzed 20 widely used health apps—covering everything from fitness tracking and sleep monitoring to diet and menstrual cycle logging—and found that every single one transmitted user data to servers in other countries, particularly the United States.

Even more concerning, these apps were found using “dark patterns”—deceptive design tactics that nudge users into giving permissions they might otherwise refuse.

While most apps appear to comply with GDPR, the European data privacy law, the study found they often violate its intent. Some apps began sending out information like advertising IDs as soon as users opened them, long before consent was granted.

Adding to the confusion, 10 out of 16 apps designed for German users offered privacy policies only in English, making it almost impossible for users to fully understand what they were agreeing to. The policies were also vague, referring to “partners” and “service providers” without naming who actually receives the data.

As the lead researcher stated, “Trust is crucial, especially when it comes to sensitive health data.”

The findings raise serious concerns about how little control users have over their private health and fitness information, which could be shared across the globe — from the U.S. to China — without their awareness.

The Bremen researchers aren’t stopping there; they’re now developing tools to automatically detect these hidden data leaks and manipulative designs. Their goal is to empower regulators and ethical developers to hold these apps accountable.

Ultimately, this study serves as a wake-up call for users and policymakers alike: the apps meant to support your health might actually be putting your privacy at risk. It’s time for clearer, stricter regulations to ensure transparency and protect users’ data from exploitation.
Read more »
internet outage
Amazon AWS Cyber incidents Cyber Outage Cyber Security E-commerce Websites Compromised internet outage

AWS Apologizes for Massive Outage That Disrupted Major Platforms Worldwide

 

Amazon Web Services (AWS) has issued an apology to customers following a widespread outage on October 20 that brought down more than a thousand websites and services globally. The disruption affected major platforms including Snapchat, Reddit, Lloyds Bank, Venmo, and several gaming and payment applications, underscoring the heavy dependence of the modern internet on a few dominant cloud providers. The outage originated in AWS’s North Virginia region (US-EAST-1), which powers a significant portion of global online infrastructure. 

According to Amazon’s official statement, the outage stemmed from internal errors that prevented systems from properly linking domain names to the IP addresses required to locate them. This technical fault caused a cascade of connectivity failures across multiple services. “We apologize for the impact this event caused our customers,” AWS said. “We know how critical our services are to our customers, their applications, and their businesses. We are committed to learning from this and improving our availability.”

While some platforms like Fortnite and Roblox recovered within a few hours, others faced extended downtime. Lloyds Bank customers, for instance, reported continued access issues well into the afternoon. Similarly, services like Reddit and Venmo were affected for longer durations. The outage even extended to connected devices such as Eight Sleep’s smart mattresses, which rely on internet access to adjust temperature and elevation. 

The company stated it would work to make its systems more resilient after some users reported overheating or malfunctioning devices during the outage. AWS’s detailed incident summary attributed the issue to a “latent race condition” in the systems managing the Domain Name System (DNS) records in the affected region. Essentially, one of the automated processes responsible for maintaining synchronization between critical database systems malfunctioned, triggering a chain reaction that disrupted multiple dependent services. Because many of AWS’s internal processes are automated, the problem propagated without human intervention until it was detected and mitigated. 

Dr. Junade Ali, a software engineer and fellow at the Institute for Engineering and Technology, explained that “faulty automation” was central to the failure. He noted that the internal “address book” system in the region broke down, preventing key infrastructure components from locating each other. “This incident demonstrates how businesses relying on a single cloud provider remain vulnerable to regional failures,” Dr. Ali added, emphasizing the importance of diversifying cloud service providers to improve resilience. 

The event once again highlights the concentration of digital infrastructure within a few dominant providers, primarily AWS and Microsoft Azure. Experts warn that such dependency increases systemic risk, as disruptions in one region can have global ripple effects. Amazon has stated that it will take measures to strengthen fault detection, introduce greater redundancy, and enhance the reliability of automated processes in its network. 

As the world grows increasingly reliant on cloud computing, the AWS outage serves as a critical reminder of the fragility of internet infrastructure and the urgent need for redundancy and diversification.
Read more »
Vidar
cyber attack Cyber Security Data Theft Vidar

New Vidar Variant Uses API Hooking to Steal Data Before Encryption

 

A recent investigation by Aryaka Threat Research Labs has revealed a new version of the Vidar infostealer that demonstrates how cybercriminals are refining existing malware to make it more discreet and effective. Vidar, which has circulated for years through malware-as-a-service platforms, is known for its modular structure that allows operators to customize attacks easily. 

The latest strain introduces a significant upgrade: the ability to intercept sensitive information directly through API hooking. 

This method lets the malware capture credentials, authentication tokens, and encryption keys from Windows systems at the precise moment they are accessed by legitimate applications, before they are encrypted or secured. 

By hooking into cryptographic functions such as CryptProtectMemory, Vidar injects its own code into running processes to momentarily divert execution and extract unprotected data before resuming normal operations. 

This process enables it to gather plaintext credentials silently from memory, avoiding noisy file activity that would typically trigger detection. Once harvested, the stolen data which includes browser passwords, cookies, payment information, cryptocurrency wallets, and two-factor tokens is compressed and sent through encrypted network channels that mimic legitimate internet traffic. 

The malware also maintains persistence by using scheduled tasks, PowerShell loaders, and randomized installation paths, while employing in-memory execution to reduce forensic traces. 

These refinements make it harder for traditional antivirus or behavioral tools to identify its presence. The evolution of Vidar highlights the need for defenders to rethink detection strategies that depend solely on file signatures or activity volume. 

Security teams are encouraged to implement Zero Trust principles, monitor API calls for evidence of hooking, and apply runtime integrity checks to detect tampering within active processes. Using endpoint detection and response tools that analyze process behavior and adopting memory-safe programming practices can further strengthen protection. 

Experts warn that Vidar’s development may continue toward more advanced capabilities, including kernel-level hooking, fileless operations, and AI-based targeting that prioritizes valuable data depending on the victim’s environment. 

The findings reflect a broader shift in cybercrime tactics, where minor technical improvements have a major impact on stealth and efficiency. Defending against such threats requires a multi-layered security approach that focuses on process integrity, vigilant monitoring, and consistent patch management.
Read more »
phishing
Biometrics Cyber Security Cybersecurity Online Security Passkeys Password password protection Passwords phishing

Passkeys vs Passwords: Why Passkeys Are the Future of Secure Logins

 

Passwords have long served as the keys to our digital world—granting access to everything from social media to banking apps. Yet, like physical keys, they can easily be lost, copied, or stolen. As cyber threats evolve, new alternatives such as passkeys are stepping in to offer stronger, simpler, and safer ways to log in.

Why passwords remain risky

A password is essentially a secret code you use to prove your identity online. But weak password habits are widespread. A CyberNews report revealed that 94% of 19 billion leaked passwords were reused, and many followed predictable patterns—think “123456,” names, cities, or popular brands.

When breaches occur, these passwords spread rapidly, leading to account takeovers, phishing scams, and identity theft. In fact, hackers often attempt to exploit leaked credentials within an hour of a breach.

Phishing attacks—where users are tricked into entering their passwords on fake websites—continue to rise, with more than 3 billion phishing emails sent daily worldwide.

Experts recommend creating unique, complex passwords or even memorable passphrases like “CrocApplePurseBike.” Associating it with a story can help you recall it easily.

Enter passkeys: a new way to log in

Emerging around four years ago, passkeys use public-key cryptography, a process that creates two linked keys—one public and one private.

  • The public key is shared with the website.

  • The private key stays safely stored on your device.

When you log in, your device signs a unique challenge using the private key, confirming your identity without sending any password. To authorize this action, you’ll usually verify with your fingerprint or face ID, ensuring that only you can access your accounts.

Even if the public key is stolen, it’s useless without the private one—making passkeys inherently phishing-proof and more secure. Each passkey is also unique to the website, so it can’t be reused elsewhere.

Why passkeys are better

Passkeys eliminate the need to remember passwords or type them manually. Since they’re tied to your device and require biometric approval, they’re both more convenient and more secure.

However, the technology isn’t yet universal. Compatibility issues between platforms like Apple and Microsoft have slowed adoption, though these gaps are closing as newer devices and systems improve integration.

The road ahead

From a cybersecurity perspective, passkeys are clearly the superior option—they’re stronger, resistant to phishing, and easy to use. But widespread adoption will take time. Many websites still rely on traditional passwords, and transitioning millions of users will be a long process.

Until then, maintaining good password hygiene remains essential: use unique passwords for every account, enable multi-factor authentication, and change any reused credentials immediately.

Read more »
personal data security
2FA 2FA security Cyber Security Data Management data security Password Security personal data security

How to Make Zoom Meetings More Secure and Protect Your Privacy

 

Zoom calls remain an essential part of remote work and digital communication, but despite their convenience, they are not entirely private. Cybercriminals can exploit vulnerabilities to steal sensitive information, intercept conversations, or access meeting data. However, several practical measures can strengthen your security and make Zoom safer to use for both personal and professional meetings. 

One of the most effective security steps is enabling meeting passwords. Password protection ensures that only authorized participants can join, preventing “Zoom-bombing” and uninvited guests from entering. Passwords are enabled by default for most users, but it’s important to confirm this setting before hosting. Similarly, adding a waiting room provides another layer of control, requiring participants to be manually admitted by the host. 

This step helps prevent intruders even if meeting details are leaked. End-to-end encryption (E2EE) is another crucial feature for privacy. While Zoom’s standard encryption protects data in transit, enabling E2EE ensures that only participants can access meeting content — not even Zoom itself. Each device stores encryption keys locally, making intercepted data unreadable. 

However, when E2EE is activated, some features like recording, AI companions, and live streaming are disabled. To use E2EE, all participants must join via the Zoom app rather than the web client. Users should also generate random meeting IDs instead of using personal ones. A personal meeting ID remains constant, allowing anyone with previous access to rejoin later. Random IDs create a unique space for each session, reducing the risk of unauthorized reentry. Two-Factor Authentication (2FA) offers further protection by requiring a verification code during login, preventing unauthorized account access even if passwords are compromised. 

Meeting links should always be shared privately via direct messages or emails, never publicly. Sharing on social platforms increases the risk of unwanted guests and phishing attempts. During meetings, hosts should manage participants closely — monitoring for suspicious activity, restricting screen and file sharing, and remaining alert for fake prompts requesting personal information. Maintaining strict host control helps minimize the risk of data theft or identity fraud. Zoom’s data collection settings can also be adjusted for privacy. 

While the platform gathers some anonymized diagnostic data, users can disable “Optional Diagnostic Data” under My Account → Data & Privacy to limit information sharing. Keeping the Zoom application up to date is equally important, as regular updates patch security vulnerabilities and improve overall system protection. Finally, operational security (OPSEC) practices outside Zoom are essential. Users should participate in meetings from private spaces, use headphones to limit audio leakage, and employ physical camera covers for additional protection. 

When connecting through public Wi-Fi, using a Virtual Private Network (VPN) adds encryption to internet traffic, shielding sensitive data from potential interception. While Zoom provides several built-in safeguards, the responsibility of maintaining secure communication lies equally with users. 

By enabling passwords, encryption, and 2FA — and combining these with good digital hygiene — individuals and organizations can significantly reduce privacy risks and create a safer virtual meeting environment.
Read more »
Subscribe to: Comments (Atom)