Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label User Privacy. Show all posts
User Privacy
Cyber Attacks Dark Web Data Leak University of Munich User Privacy

Cyberattack Hits University of Munich, Exposing Student Data

 

Germany’s Ludwig Maximilian University of Munich (LMU) is investigating a significant cyberattack that potentially exposed sensitive student information, including financial aid and health insurance data. The breach, detected on a Wednesday, led the university to disconnect affected servers and engage external cyber security experts while cooperating with law enforcement. 

The compromised records reportedly include students’ names, dates of birth, contact details, LMU email addresses, bank account information, and details about their courses of study and prior educational qualifications. In some cases, health insurance numbers and identifiers linked to Germany’s student financial aid program may also have been accessed, along with data related to leaves of absence. However, the university confirmed that examination records, specific course content, and individual academic performance data were not affected. 

Operational impact and response 

Following the discovery of the breach, LMU took several systems offline as a precaution, temporarily disrupting some internal services. While teaching activities continued uninterrupted, enrollment processes were briefly suspended and are expected to resume with extended deadlines to ensure students are not disadvantaged. Some students reported difficulties accessing university services needed for semester preparation, including course registration and grade viewing. The institution has not disclosed the number of affected individuals or the duration of unauthorized access, and no ransom demand has been publicly confirmed. 

Universities remain attractive targets for cybercriminals due to their extensive networks containing vast amounts of personal and financial information across large populations of students, researchers, and staff. Recent ransomware attacks have affected prominent U.S. institutions such as the University of Texas, University of Oklahoma, Stanford University, and the University of Michigan, with several incidents occurring after holiday breaks. Other notable cases include disruptions at the University of Pennsylvania, Columbia University, and Harvard University over the past years.

LMU has enlisted specialists to monitor dark-web forums and other platforms for signs that the stolen information is being circulated or misused. While there is currently no evidence that the data has been altered, deleted, or published, the investigation remains ongoing to determine the full extent of the breach. The attacker has not yet been identified, and the university continues to work with cybersecurity professionals and authorities to secure its systems and protect affected students.
Read more »
User Privacy
IMEI Blocking Lost Phone Security Mobile Security Network Flaws User Privacy

Lost Phone Reporting Flaws Could Let Hackers Block Any Mobile Device for $4


A new security investigation has revealed serious weaknesses in the systems used by mobile carriers to block lost or stolen phones. Researchers found that an attacker could exploit these flaws to disconnect another person’s smartphone—or even a cellular-connected home alarm—from mobile networks for as little as $2.50 to $4. The attack reportedly took between 20 and 80 seconds, raising concerns about the reliability of a process designed to protect phone owners. 

When a customer reports a phone as lost or stolen, the carrier records the handset’s unique International Mobile Equipment Identity (IMEI) number in an Equipment Identity Register, or EIR. Mobile networks then use this database to reject the device and prevent it from registering for calls, messages and data services. The system is also designed to discourage theft because a blacklisted phone may become unusable, even if someone replaces its SIM card. However, researchers discovered that the process contains weaknesses across multiple layers. 

The study identified six flaws affecting devices, carrier reporting systems and the infrastructure used by telecom companies to exchange blocked-device lists. These weaknesses could allow criminals to submit fraudulent reports or manipulate information without proving that they own the targeted handset. In addition to smartphones, the problem may affect connected security systems and other Internet of Things devices that rely on cellular networks. A malicious actor could potentially disrupt a home alarm, surveillance system or other connected equipment by falsely reporting its IMEI as stolen. 

The findings highlight the risks of trusting a single identifier as proof of ownership. Although IMEI-based blocking can be useful, carriers may need stronger verification, better monitoring and faster recovery procedures for legitimate customers. Providers could require additional account checks, detect unusual reporting patterns and notify owners before permanently adding a device to a blacklist. They should also make it easier for customers to challenge fraudulent blocks and restore service quickly. 

For phone owners, the investigation is a reminder to secure accounts and keep evidence of ownership. If a device disappears, users should immediately activate Android’s Find My Device or Apple’s Find My service, remotely lock the handset and contact their carrier to suspend the SIM or eSIM. They should change important passwords, monitor banking accounts and report suspected theft to the police. Customers who discover that their device has been wrongly blocked should contact the carrier, request an investigation and provide purchase records, account details and the handset’s IMEI number.
Read more »
User Privacy
Android Trojan Data Theft malware MantaxOtax User Privacy

MantaxOtax Android Malware Merges Ransomware and Spyware in New Indonesian Campaign

 

MantaxOtax is a newly identified Android malware that merges ransomware-style file encryption with aggressive spyware capabilities, enabling attackers to both lock users out of their devices and harvest sensitive personal data. Discovered by Zimperium's zLabs team and detailed in a September 9 technical write-up, the threat appears linked to Indonesian actors and spreads primarily via sideloaded APKs hosted on third-party file-sharing platforms. This dual-function design marks a significant escalation in mobile threats, combining financial extortion with deep surveillance to maximize victim impact. 

Once installed, MantaxOtax requests device administrator privileges, followed by permissions for SMS, contacts, audio, images, and Android Accessibility services, which grant it deep control over user interactions. It dynamically resolves its command-and-control (C2) domain from a GitHub repository, allowing operators to shift infrastructure without modifying the malware code. 

On Android 9 and earlier, it recursively scans external storage, encrypts files using AES with unique per-device keys fetched from C2, deletes originals, and leaves behind .enc files; on Android 10+, Scoped Storage limits encryption to the app's own directory. The malware also overwrites victims' images with ransom notes and opens a Firebase-based chat interface for extortion negotiations, which researchers found partially exposed due to a server misconfiguration. 

Beyond encryption, MantaxOtax operates as a full-featured spyware, collecting app inventories, hardware specs, location, browser history, notifications, contacts, call logs, and SMS—including one-time passwords (OTPs). It exfiltrates gallery content, linked Google accounts, WhatsApp profiles and messages (via Accessibility), and Telegram credentials and chat histories. By abusing Android's MediaProjection API, it captures screenshots, records MP4 screen videos, and streams near-real-time footage to attackers, storing media on the Catbox file host. It can also silently activate front or rear cameras to take photos without user knowledge, turning infected devices into always-on surveillance tools. 

Researchers observed multiple variants employing psychological pressure tactics: persistent screen locks, application blocking, and transparent overlays that hijack all touch input. Some versions bombard victims with repeating alert dialogs, full-screen video overlays, and image popups appearing every 600 milliseconds, while others use text-to-speech to audibly deliver attacker messages. A second iteration adopted WebSocket communications for more resilient C2 channels and added features like continuous screen locking and app blacklisting, making remediation harder for average users. These harassment techniques are designed to overwhelm victims into compliance, increasing the likelihood of ransom payment or credential surrender. 

Evidence including language markers and recovered victim files suggests MantaxOtax primarily targets Indonesian users. The misconfigured server also leaked what appears to be the operators' control panel, offering rare insight into their infrastructure. This campaign follows closely after the discovery of THost9, another Android trojan that clones banking apps into isolated work profiles to evade detection. Together, these threats underscore a growing trend of multi-stage mobile malware combining financial fraud, surveillance, and ransomware—highlighting the critical need for users to avoid sideloading apps, keep devices updated with the latest security patches, and use reputable mobile security solutions to detect and block such sophisticated threats before they cause harm.
Read more »
User Privacy
Android Chrome Cloud Data Google Internet User Privacy

Google Chrome's New Defense Model to Protect Users Against Malicious Notifications


According to Google, Chrome’s anti-abuse system has decreased unwanted notifications in the first quarter of 2026 by over 7 billion daily on Android.

In a new blog post, Google said that notification exploits have been used to spread malware, scams, fake payment requests, and phishing attempts.

To decrease the exploit, Google made a “Swiss cheese” defense system, where numerous overlapping systems simultaneously try to stop exploit at different levels.

According to Google, "Our goal is to ensure that if abuse slips through one layer, another is there to catch it. This approach allows us to halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security."

Automatic notification permission removal by Chrome

Currently, Chrome can already revoke notification permissions from inactive sites, and also from websites that continuously give suspicious-notification warnings.

This can automatically unsubscribe a user from a website’s notification if Chrome removes the permission.

According to Google, users can still see the automatically revoked permissions in Safety Hub and permit access again if they wish to.

Users can also unsubscribe from notifications directly from the notifications panel of Android.

Besides allowing users more control, Google is studying user behaviour throughout networks of associated websites. This includes coordinated service-worker activity, to look out for groups spreading harmful or malicious notifications. 

According to Google, "This enables us to proactively revoke permissions from these persistent bad actors, protecting users from deceptive notifications even when the site content might not seem inherently malicious."

Google analyzes factors including time you spend on a website, engagement, permission-prompt frequency, and notification volume. 

For instance, websites categorized as malicious can be restricted to 1,000 messages per minute, with additional requests showing an HTTP 429 error. These restrictions are reset after a period of non-disruptive behaviour and can be more strict for repeat violators, Google said.

Users can also control notification settings

Chrome has also modified how notification permissions prompts function on Android. Chrome has built a relatively less disruptive interface for users to decide if they want certain notification without poking their browsing. 

"This strategy has substantially decreased unnecessary background activity, reduced user device battery consumption, and transformed the notification lifecycle so users receive only the content they find truly valuable," Google said.

How to turn on settings

For users who want to manually control these settings, for Chrome users, “On Desktop, navigate to Settings > Privacy and security > Site Settings > Notifications, or open chrome://settings/content/notifications in the omnibox,” Google said.

For android, “tap More (⋮) > Settings > Notifications.”

Read more »
User Privacy
Abortion Data Leak Data Breach Financial crime ShinyHunters User Privacy

ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam

 

Cybercriminals are exploiting email addresses exposed in previous ShinyHunters data leaks to conduct a new sextortion campaign demanding $2,000 in Bitcoin. The fraudulent messages falsely claim that ShinyHunters compromised victims’ phones and computers, accessed their cameras and microphones, and recorded them visiting adult websites. However, the campaign appears to involve unrelated scammers who downloaded previously leaked information and are using it to make their threats appear credible. 

The emails reportedly use random sender addresses and names such as “ShinyHunters” or “You’ve Been HACKED.” Their subject line commonly reads “Information about your online security.” In the messages, attackers mention companies whose databases were previously exposed, including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. By identifying a company connected to the recipient’s email address, scammers attempt to create the impression that they specifically targeted the victim. 

The scam messages claim that attackers installed malware capable of accessing a victim’s microphone, camera, keyboard, photographs, browsing history, conversations, and contact list. They then threaten to send allegedly recorded intimate videos to the recipient’s family, friends, colleagues, and business contacts unless payment is made within 48 hours. The emails also instruct recipients not to contact law enforcement, reply, or reset their devices, claiming that stolen data is stored on remote servers. These warnings are intimidation tactics rather than evidence of a genuine device compromise. 

According to the report, the campaign may have begun in April, with victims and organizations sharing similar warnings online. Betterment acknowledged that some customers received threatening emails and described them as a common extortion scam. The company emphasized that knowing someone’s email address does not give criminals the ability to install malware or access that person’s device. It advised recipients not to reply, pay, click links, or open attachments, while asking anyone who interacted with the message to contact its fraud team. 

People receiving these emails should remain calm and avoid paying the Bitcoin demand, because payment does not guarantee that scammers will stop contacting them. Recipients should preserve the message as evidence, report it to their email provider and relevant cybercrime authorities, then delete it after checking for suspicious account activity. They should also use unique passwords, enable multifactor authentication, update devices, and monitor accounts associated with the exposed email address. The campaign demonstrates how data stolen in one breach can later be reused by unrelated criminals to support convincing but false threats.
Read more »
User Privacy
Data Breach Korean Military medical records South Korea User Privacy

South Korean Military Medical System Breached, 1.15 Million Records at Risk

 

South Korea’s military has reported unauthorized access to a medical imaging system containing sensitive records linked to approximately 1.15 million people. The incident involved the Armed Forces Medical Command’s mobile Picture Archiving and Communication System, commonly known as PACS, which enables medical staff to view X-rays, CT scans and MRI images. Although investigators have not confirmed that information was stolen, the breach has raised serious concerns about the security of military healthcare data. 

According to the Defense Ministry, the intrusion took place between November and December 2025 and may have involved approximately 8 gigabytes of medical information. This estimate was based on network traffic, rather than a confirmed list of downloaded files. Officials said the amount could be equivalent to nearly 1,000 X-ray images, but they have not identified the exact records that may have been viewed or accessed. 

The potentially exposed information includes patients’ names, sex, ages, medical imaging dates and diagnostic images. The system was used by six military hospitals located in Goyang, Yangju, Pocheon, Gangneung, Guri and Daegu. However, authorities emphasized that the figure of 1.15 million represents all individuals whose records were stored in the system, not the number of people whose information was definitely accessed or copied. 

The breach was discovered in April during a security inspection led by the Defense Counterintelligence Command. In June, the Defense Ministry, Defense Cyber Command, Defense Counterintelligence Command and Armed Forces Medical Command formed a joint investigation team to determine how the unauthorized access occurred and assess its full impact. Investigators reportedly found that an open network communications port allowed the intruder to enter the system, and that the port remained exposed from November 2025 until March 2026. 

The military suspended the medical imaging system immediately after identifying the incident. Officials have not disclosed the identity or origin of the intruder, nor have they confirmed whether any medical information was transferred outside the network. The case highlights the risks created by exposed network ports and insufficient access controls, particularly in systems containing health and military data. South Korea’s Defense Ministry said it would correct the identified weaknesses and strengthen cybersecurity measures to prevent similar incidents in the future.
Read more »
User Privacy
ALPR Cyber Security Flock Cameras Florida User Privacy

Flock Cameras Blanket Southwest Florida, Sparking Privacy and Safety Backlash

 

Flock Safety's automated license plate reader (ALPR) cameras are spreading rapidly across Southwest Florida, with hundreds now installed at intersections, parking lots, and private communities. These solar-powered devices, mounted on poles along roads, capture detailed vehicle data—including license plates, make, model, color, and unique features like bumper stickers or dents—every time a car passes. The information is instantly uploaded to a shared law enforcement database, enabling police to search and track vehicles without warrants, raising serious privacy concerns among residents and civil liberties advocates.

The network's growth in Southwest Florida reflects a national trend, with over 100,000 Flock cameras now mapped across the United States. In Cape Coral and surrounding Lee and Charlotte counties, cameras are so dense that some intersections have readers on every corner. Local agencies, including the Cape Coral Police, Sanibel Police, and county sheriffs, use Flock or access its shared data, while private gated communities and businesses also deploy cameras that feed into the same system. Florida law allows agencies to query Flock records from other jurisdictions nationwide without a warrant, amplifying the reach of this surveillance infrastructure.

Critics argue that Flock's technology enables mass surveillance, as the AI-powered cameras generate "vehicle fingerprints" and log every trip, from grocery runs to medical appointments. Privacy advocates warn that the data can be misused: police officers have been caught using Flock networks to stalk ex-partners, with hundreds of illegal license plate searches documented. Additionally, a 2025 investigation found at least 60 Flock cameras exposed to the open internet, allowing outsiders to view live footage, highlighting security vulnerabilities in the system. 

Backlash against Flock has intensified, with citizens in five states destroying cameras using sledgehammers and vice grips, while city governments in Fort Collins, Eugene, Madison, and others have canceled contracts or deactivated the devices. At the federal level, Representative Thomas Massie plans to introduce legislation blocking federal funding for Flock cameras, citing civil liberties concerns. Road safety advocates have also raised alarms, noting that Flock's 80,000 to 100,000 roadside poles may violate federal clear-zone rules, creating crash hazards beyond privacy issues. 

As Flock cameras expand into retail parking lots—Home Depot and Lowe's have deployed them nationwide—the debate over warrantless surveillance and data sharing is set to intensify. For Southwest Florida residents, the visible proliferation of these devices underscores a broader tension between law enforcement capabilities and the right to privacy in public spaces.
Read more »
User Privacy
Cyber Security Data Leak Location Sharing User Privacy

Location Sharing: Convenience at the Cost of Safety

 

Location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust. 

The most immediate danger is physical safety. Continuous location sharing reveals where you live, work, study, and spend leisure time, effectively mapping your routine for anyone with access. Stalkers, harassers, or opportunistic criminals can exploit this data to time thefts, orchestrate impersonation scams, or physically follow you. Real-time updates on platforms like Snapchat’s Snap Maps make it trivial to see when you are home or away, turning a social feature into a surveillance tool if permissions are too broad. 

Beyond individual bad actors, the apps themselves and their data ecosystems present another layer of risk. Many services collect and retain location histories, which can be sold to data brokers, advertisers, or accessed by third parties through data breaches. Incidents like the Gravy Analytics hack show how aggregated location data can leak at scale, exposing users who never intended their movements to be public. Even when companies claim strong security, breaches and insider misuse remain persistent threats in today’s threat landscape. 

Location data also fuels more sophisticated cyberattacks through social engineering and targeted fraud. Attackers can correlate your whereabouts with spending habits, social posts, and device usage to craft convincing phishing messages, fake support calls, or credential-reset scams. For example, seeing that you just visited a shopping mall or a specific campus building can help criminals personalize spam about credit-card fraud or IT alerts, increasing the chance you click a malicious link. Geotagged photos and live stories further amplify this risk by publicly broadcasting your precise coordinates. 

Mitigating these risks requires deliberate permission management and a mindset Of location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust.
Read more »
User Privacy
Cyber Security Instagram AI Meta Muse User consent User Privacy

Meta’s Muse AI: How Instagram Users Can Opt Out After Privacy Backlash

 

Meta’s short‑lived Muse Image AI on Instagram let users remix public photos into AI images by default, triggering a storm of privacy and consent backlash before Meta pulled the feature. Meta’s Muse Image tool was designed to turn Instagram into a generative AI playground, allowing people to create new images using photos from any public account. 

By tagging a public handle in an AI prompt, users could generate stylised visuals that borrowed someone else’s likeness or feed without ever asking permission. Meta framed Muse as a creative upgrade, promising strong safety guardrails and quick controls for those who wanted to opt out. But that framing collapsed almost immediately once people realised just how much quiet data sharing sat behind the feature.  

The core problem was consent: adult users with public profiles were opted in automatically, with no upfront notice or explicit choice. Anyone could be remixed into AI art by strangers simply because their account wasn’t private. Reports showed Muse could generate images of people who had never interacted with the tool at all, including photos featuring children who obviously couldn’t consent to such reuse. To make matters worse, Meta’s own policy confirmed users would not be notified when their content was used in AI features, keeping the whole process largely invisible.  

Creators, unions and privacy advocates quickly denounced the opt‑out model as an inversion of basic digital rights. Hollywood unions and talent agencies warned that Muse normalised non‑consensual manipulation of someone’s image and could undermine control over professional likeness and copyrighted work. Digital rights groups called the rollout a “privacy landmine”, pointing to existing harms from deepfakes and non‑consensual AI imagery elsewhere on the internet. Their argument was simple: protection should be the default, and any AI reuse of identity should require explicit, informed opt‑in.  

Under pressure, Meta stressed that private accounts and users under 18 were automatically excluded from Muse, and that any public user could disable the feature with a few taps in Instagram’s Sharing and Reuse settings. Users could also flip their profile to private to lock themselves out of AI remixes entirely. But critics noted these controls were buried, easy to miss and did nothing to remove AI images already generated from someone’s posts. For many, this reinforced the sense that meaningful control arrived only after the data had already been exploited.  

Within days of launch, the backlash forced Meta to pause and then remove the Instagram implementation of Muse Image, admitting the feature “missed the mark” on user expectations. The episode has become a case study in how not to roll out AI features on social platforms, especially when they touch identity and consent. It underscores a wider shift in user sentiment: AI creativity is welcome, but only when people remain clearly informed, empowered and in control of how their content trains or feeds the machine.
Read more »
User Privacy
Cyber Crime French Teacher Minor Safety Sexual Exploitation User Privacy

AI Vigilante Sting Catches Alleged Paedophile Ex-Teacher in France

 

A retired French physical education teacher has been placed in custody after an online sting operation exposed what investigators say was a serious attempt to solicit a minor. The case has drawn wide attention because the “girl” he was speaking to was not real, but a digitally created identity controlled by an influencer known for targeting alleged predators. The meeting was streamed live, turning a criminal investigation into a public spectacle. 

According to the BBC report, the 66-year-old man, identified as Dominique B, surrendered to authorities in eastern France one day after the exchange was broadcast. During the 40-minute interaction, he believed he was speaking with a 14-year-old girl, but the image and voice were being operated by a male influencer. Even though the visual disguise was imperfect, the setup was convincing enough to lead the retired teacher into inappropriate conversation. 

The exchange reportedly attracted more than 40,000 live viewers and later approached a million views online. In the footage, the man is seen relaxing in a chair while the fake persona appears on screen, with the influencer adjusting his appearance to help maintain the illusion. The stunt’s reach shows how online platforms can amplify both exposure and controversy when criminal behavior is broadcast in real time. 

French prosecutors in Vesoul say the man now faces charges for making sexual propositions to a person under 15 and for soliciting pornographic images from a minor. Those allegations carry serious legal and social consequences, especially given his former role as an educator. The case is likely to fuel further debate over the line between citizen-led vigilance and public shaming in digital spaces. 

The influencer involved said his aim was to raise awareness, but the incident also highlights the growing use of deceptive online identities in anti-predator campaigns. While such tactics can expose dangerous behavior, they also raise questions about evidence, ethics, and the influence of livestream culture. For now, the French case stands as a stark reminder that online anonymity can be abused, and that public exposure is no substitute for lawful accountability.
Read more »
User Privacy
Africa Cyber Crime data security Digital Fraud User Privacy

Africa’s Digital Boom Makes It a Prime Target for Hackers

 

Africa’s digital boom is reshaping how people bank, work, study, and access public services, but that same progress is creating fresh openings for cybercriminals. As more governments and businesses move services online, attackers are finding more valuable systems to exploit, from mobile payments and health platforms to tax portals and identity databases. 

The speed of digital adoption has often outpaced security investment, leaving weak points that can be difficult to fix later. In practical terms, the more connected Africa becomes, the larger the attack surface becomes for criminals looking for easy gains. One of the biggest risks is that many organizations still rely on limited budgets, outdated infrastructure, and a shortage of trained cybersecurity professionals. 

Reports note that cybercrime losses in Africa now exceed $4 billion a year, while mobile-first threats such as SIM-swap fraud, phishing, and mobile money scams continue to rise. In some markets, cyberattacks are becoming more sophisticated, with criminals using automation and AI to make scams harder to detect. This is especially dangerous in countries where essential digital services are expanding quickly but security systems have not kept pace. 

The problem is not only technical; it is also structural. Africa’s cybersecurity rules remain uneven across countries, making it harder to coordinate responses to cross-border attacks. Criminal groups can move between jurisdictions, exploit weak enforcement, and target victims at scale while leaving limited traces behind. At the same time, critical infrastructure such as power, telecoms, and hospitals is increasingly exposed because it depends on connected systems that are often not built with strong protection in mind. That combination of weak regulation, limited staffing, and rising digital dependence makes the continent an attractive hunting ground for hackers. 

Cybersecurity experts argue that the solution must go beyond software and firewalls. Governments need stronger laws, better information-sharing, and more investment in training so that local teams can respond quickly to attacks. Businesses need to treat security as a core cost of digital growth, not an afterthought. Public awareness is also crucial, because many successful attacks still begin with simple tricks such as fake emails, urgent payment requests, or fraudulent links. If users understand the risks, the most common scams become much harder to carry out. 

Africa’s digital future remains full of promise, but that promise depends on trust. If people cannot safely use online services, digital progress slows and confidence erodes. The continent now faces a clear choice: keep expanding online systems faster than they can be protected, or build security into digital growth from the start. The countries that succeed will be the ones that match innovation with resilience, and speed with discipline.
Read more »
User Privacy
Cyber Security Meta Meta Glass Smart Glasses User Privacy

Meta Smart Glasses Secretly Film Women: Privacy Invasion Crisis Explained

 

Smart glasses are moving from novelty to mainstream, and Meta’s Ray-Ban model is leading the market. The BBC says Meta accounts for about 80% of sales in the smart-glasses category, helped by the familiar Ray-Ban design and the addition of a built-in camera, speakers, and AI features. That combination has made the product appealing to early adopters who want hands-free music, calls, photos, and information on the go. 

But the same features that make smart glasses attractive also make them controversial. The report describes women being filmed without their knowledge by men wearing the glasses, often in everyday settings such as beaches, shops, and sidewalks. Those videos can later appear online and attract harassment, while the people recorded may not even realize it happened until much later. 

Privacy concerns are not limited to casual misuse. The report says some wearers have been surprised to discover what their glasses were recording, while lawsuits have also been filed over videos captured through the devices and used for AI training. In addition, experts quoted in the report warn that if smart glasses become common, it may become much harder to enforce norms around sensitive places like courthouses, hospitals, museums, and bathrooms. 

Meta says the glasses are designed with privacy in mind and that users should behave responsibly. The company’s spokesperson told the BBC that it has teams focused on limiting misuse, but also argued that the ultimate responsibility lies with individual users. Even so, the report notes that visible indicators like the recording light may be too subtle to reliably alert bystanders, especially in bright outdoor conditions.

Despite the backlash, the commercial momentum is strong, and other major tech firms are preparing their own versions. Apple, Snap, and Google are all reportedly working on smart-glasses products, suggesting this could become a major new consumer category rather than a passing trend. The BBC’s reporting points to a familiar tech dilemma: a device can be genuinely useful while still raising difficult questions about consent, surveillance, and the limits of public privacy.
Read more »
User Privacy
Android Trojan Data Harvesting Data Leak malware User Privacy

Millions of Devices at Risk: New Trojan Monitors Smartphones

 

A menacing new Trojan has emerged that puts millions of smartphone devices worldwide at risk, according to recent cybersecurity reports. This sophisticated malware specifically targets Android devices and has already infected thousands of users across 143 countries. The Trojan's ability to monitor smartphones in real-time represents a significant evolution in mobile cyberthreats, with security researchers warning that the actual infection count could be far higher than currently detected.

The malware spreads primarily through seemingly legitimate websites that trick users into downloading malicious applications. Once installed, the Trojan grants hackers complete remote control over compromised devices, enabling live monitoring of user activities. Security firm Zimperium zLabs identified similar dangerous Trojans like Arsink, which impersonates popular brands including WhatsApp and TikTok to evade detection. The infected devices can have their audio recorded, text messages read, and even be wiped completely by attackers. 

This Trojan's most alarming capability is its live monitoring feature combined with coordinated attack systems. Beyond stealing credentials, the malware transmits live screen content to remote servers, creating a continuous visual feed that allows attackers to observe activity and intercept authentication steps in real time. Encrypted communication channels connect infected devices to centralized command systems that coordinate attacks and distribute updated instructions, managing thousands of compromised devices simultaneously. The infection has created a massive footprint, with Egypt reporting around 13,000 compromised phones, Indonesia approximately 7,000, and Iraq and Yemen each with 3,000 infections. 

The Trojan harvests an extensive range of sensitive data including SMS messages, call logs, contacts, device location, and Google account information. It can steal user accounts in messengers and social networks, stealthily send messages on behalf of victims, monitor browser activities, replace links, swap numbers during calls, and intercept SMS messages. Previous similar malware campaigns have already stolen at least $270,000 worth of cryptocurrency, suggesting the financial damage from this new Trojan could be substantial. 

Experts recommend several critical protection measures to safeguard against this threat. Users should only download applications from official app stores like Google Play, avoid clicking links from suspicious websites, and keep their Android operating system updated with the latest security patches. Google has warned that over 40% of Android devices remain vulnerable because they run outdated versions without security support. If your smartphone brand no longer provides security updates, experts strongly recommend considering a new device to protect your personal data.
Read more »
User Privacy
Beagle Backdoor Claude AI Malvertising malware User Privacy

Fake Claude AI Site Spreads New Beagle Windows Backdoor – Here’s How to Stay Safe

 

Cybercriminals have launched a sophisticated malvertising campaign using a fake Claude‑AI website that installs a new Windows backdoor called “Beagle,” highlighting how attackers are weaponizing the popularity of AI tools against software developers. The deceptive site, reachable through sponsored search results, mimics Anthropic’s legitimate Claude interface and lures users into downloading what appears to be a productivity‑oriented “Claude‑Pro Relay” tool but is in fact a poisoned installer.

Modus operandi 

The malicious domain claude‑pro[.]com presents a stripped‑down clone of the official Claude design, using similar colors and fonts to create a veneer of legitimacy. However, most navigation links on the page simply redirect back to the homepage, and the only functional element is a large download button that serves a 505‑MB archive named Claude‑Pro‑windows‑x64.zip, which contains a trojanized MSI installer. Users who bypass standard security hygiene—such as verifying the URL or ignoring suspicious “sponsored” tags—end up deploying this bundle on their machines. 

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll. The first file is a legitimate, digitally signed updater from G Data security software, which attackers abuse via DLL sideloading to load the malicious avk.dll instead of the genuine library. This DLL decrypts the encrypted data file, then executes the open‑source in‑memory loader DonutLoader, which in turn deploys the final payload—the Beagle backdoor—entirely in memory to evade disk‑based detection.

Beagle backdoor capabilities

Beagle is a lightweight but dangerous Windows backdoor that gives attackers remote control over an infected system. It supports a small set of commands such as running arbitrary shell commands, uploading and downloading files, creating and renaming directories, listing folder contents, and uninstalling itself to destroy evidence. The malware communicates with its command‑and‑control server at license[.]claude‑pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key to make network monitoring more difficult. 

Attribution and broader implications Security researchers have not yet pinned the campaign to a specific named threat group, but they note technical overlaps and suggest the same actors behind the PlugX malware family may be experimenting with this new payload. The fact that the attackers impersonate major security vendors in other related samples—such as Trellix, CrowdStrike, SentinelOne, and Microsoft Defender—points to a broader malvertising and supply‑chain‑style strategy.

How users and organizations can protect themselves 

Organizations should block the domains claude‑pro[.]com and license[.]claude‑pro[.]com at the DNS and firewall level and search endpoints for NOVupdate.exe and avk.dll in Startup folders, which are strong indicators of compromise. End users, especially developers, must download Claude and similar AI tools only from verified official domains, treat sponsored search results with skepticism, and verify URLs before clicking installers. Updated endpoint protection, EDR logging, and user‑awareness training on AI‑related phishing and malvertising are critical to mitigating this evolving threat.
Read more »
User Privacy
Aadhaar Scam Ahemdabad AI Deepfakes Cyber Fraud User Privacy

AI Deepfake Scam Changes Aadhaar Mobile Without OTP

 

AI-enabled fraudsters are now using deepfake tools to change Aadhaar details, such as the mobile number linked to an account, without victims noticing, enabling identity theft and loan fraud.

In Ahmedabad, cybercrime investigators uncovered a racket that quietly replaced victims’ Aadhaar-linked mobile numbers and then used those new numbers to intercept OTPs and take control of digital services, including DigiLocker and banking apps. The gang reportedly collected Aadhaar numbers, photographs and other personal data from leaks and social media, then used AI software to turn still photos into short “blink” videos that mimic liveness checks and fool verification systems. 

Once the fraudsters changed the registered mobile number, they could receive OTPs and update KYC details, effectively hijacking victims’ digital identities and applying for loans or accessing accounts in their names. Police say the operation was organised with distinct roles: some members sourced data and photos, others used Aadhaar update kits—often through Common Service Centres (CSCs)—to make unauthorised changes, and specialists created deepfake clips to pass biometric checks.

Authorities arrested several suspects after a businessman reported that his Aadhaar-linked number was altered without any OTP or call alerts, revealing how smoothly the criminals combined social engineering, physical update kits, and AI manipulation to bypass safeguards. Reports indicate the attackers exploited weaknesses in offline update workflows and gaps in liveness-detection systems that still accept AI-generated motion as genuine.

Safety recommendations 

To protect yourself, regularly verify the mobile number linked to your Aadhaar and lock your biometrics using official mAadhaar or UIDAI services when not in use. Monitor DigiLocker and bank accounts for unexpected changes and set up transaction alerts with your bank; if you spot unusual activity, report it immediately to local cybercrime units or UIDAI’s helplines. Avoid uploading Aadhaar photos or documents on unfamiliar platforms and be cautious about sharing personal information on social media, which criminals can reuse to create realistic deepfakes. 

Longer-term fixes will require stricter controls around Aadhaar update kits at CSCs, better audit trails for demographic changes, and improved liveness-detection algorithms that can distinguish AI-generated clips from real facial movement. Experts and regulators also urge faster data-breach notification rules and tighter controls on access to identity databases so criminals cannot easily assemble the building blocks for such attacks. Until these systemic changes arrive, vigilance, biometric locks, and immediate reporting remain the best defenses for citizens.
Read more »
User Privacy
AI Chatbots OII Research Technology User Privacy

Friendly AI Chatbots More Likely to Give Wrong Answers, Study Finds

 

Artificial intelligence chatbots that are designed to sound warm, friendly, and empathetic may be more likely to give wrong or misleading answers than their more neutral counterparts, according to a new study by researchers at the Oxford Internet Institute (OII). The findings raise concerns about how much users can trust AI assistants that have been deliberately tuned to feel more human‑like and emotionally supportive. 

What the study found 

The researchers analyzed over 400,000 responses from five major AI systems that had been modified to communicate in a more amiable, empathetic tone. They discovered that these “warm models” produced more factual errors than the original, less friendly versions, with error rates rising by an average of 7.43 percentage points across tasks. In some cases, the warm‑modeled chatbots not only gave incorrect information but also reaffirmed users’ mistaken beliefs, particularly when expressing emotion.

The OII team describes this as a “warmth‑accuracy trade‑off”: the more the models are optimized to be agreeable and supportive, the more their reliability drops. Lead author Lujain Ibrahim told the BBC that, like humans, AI can struggle to deliver honest but uncomfortable truths when its main goal becomes being likable rather than being accurate. This mimics a human tendency to soften harsh feedback to avoid conflict, but in an AI context it can mean dangerous misinformation, especially on topics like health or legal advice. 

 Risks for users

The risk is especially serious because people are increasingly using chatbots for emotional support, mental‑health guidance, or even medical and financial advice. If a friendly AI constantly agrees with users or gives reassuring but false answers, it can reinforce harmful misconceptions instead of correcting them. The study notes that such “warm” tuning can create vulnerabilities that do not exist in the original, less sociable models, making it crucial for users and developers to treat these systems as fallible tools rather than infallible experts. 

The paper urges developers to rethink how they fine‑tune chatbots for companionship or counseling, emphasizing the need to balance empathy with factual rigor. Some industry leaders have already warned against “blindly trusting” AI outputs, and many platforms now include prominent disclaimers about potential inaccuracies. However, the OII research suggests that simply making an AI sound more friendly can quietly increase those risks, meaning future design choices must explicitly prioritize truthfulness over artificial charm.
Read more »
User Privacy
AI Threat Cyber Security Malicious Attack Prompt Injection User Privacy

Indirect Prompt Injection: The Hidden AI Threat


Indirect prompt injection is becoming one of the most worrying AI security risks because attackers can hide malicious instructions inside content that an AI system reads and trusts. In plain terms, the AI is not being attacked through the chat box alone; it can also be manipulated through emails, web pages, documents, or other external data it processes. 

The danger is that these hidden prompts can make an AI leak sensitive data, follow malicious commands, or guide users to malicious websites. Security experts note that cybercriminals are already using this technique to push AI systems toward unsafe actions, including executing code and exposing information. That makes the problem more serious than a simple model glitch, because the output can directly affect real-world decisions and user safety. 

A major reason indirect prompt injection works is that many AI systems mix trusted instructions with untrusted content in the same workflow. If the system does not clearly separate what should be obeyed from what should merely be read, the model may treat attacker-controlled text as if it were part of its core task. This is especially risky in agentic tools that can browse, summarize, click links, or take actions on behalf of users. 

Security experts recommend building multiple layers of defense instead of relying on one fix. Common measures include sanitizing input and output, using clear boundaries around external content, enforcing least privilege, and requiring human approval for sensitive actions. Monitoring unusual behavior also helps, such as unexpected tool calls, odd requests, or suspicious links in AI-generated responses. 

For users, the safest habits are simple but important. Give AI tools only the access they truly need, avoid sharing unnecessary personal data, and be cautious when an AI suddenly recommends links, purchases, or requests for sensitive information. If the system starts acting strangely, the session should be stopped and the output verified independently before trusting it.

The broader lesson is that prompt injection is now a practical cybersecurity issue, not a theoretical one. As AI becomes more connected to browsers, inboxes, databases, and business workflows, attackers gain more ways to exploit weak guardrails. Organizations that want to use AI safely will need strict controls, continuous testing, and a security-first design mindset from the start.
Read more »
User Privacy
Data Breach Fitness Bands Strava UK Military User Privacy

Fitness Tracking Under Fire: Strava Leak Exposes Military Personnel

 

Fitness tracking apps have become a daily habit for millions of people, but a new Strava military data leak is raising old privacy fears again. According to recent reporting, activity logs linked to more than 500 UK military personnel were exposed through exercise data that could be connected to sensitive locations. What looks like an innocent run or bike ride can, when combined with account details and route history, reveal where people live, work, and train. The case is a reminder that fitness data is not just about calories and distance; it can also map routines, movement patterns, and security-sensitive sites. 

The problem is not limited to one incident. Strava has faced privacy concerns before, including warnings that its heatmap and route-sharing features could be used to identify military bases, homes, and individual users. Researchers have shown that even anonymized or aggregated location data can be re-identified when enough patterns are available. In earlier cases, public activity data exposed military facilities and personnel movements, prompting defense agencies to tighten guidance on how service members use connected devices. That history makes the latest leak more troubling because it shows the same basic risk still exists. 

At the heart of the issue is location data. Fitness apps collect GPS routes, timestamps, workout frequency, and sometimes health-related information such as heart rate or sleep trends. When that information is shared publicly, or even stored in ways that can be aggregated, it becomes easier to infer personal routines and secure locations. Privacy settings help, but they are not always enough if users do not understand how default sharing, heatmaps, and visible activity histories work. That gap between user expectations and data reality is what makes these apps risky. 

For military organizations, the lesson is clear: location discipline matters. Personnel need stronger rules on wearable devices, stricter defaults for app privacy, and regular training on how seemingly harmless data can be weaponized. For consumers, the safer approach is to review visibility settings, disable public sharing, and avoid recording workouts near home, workplace, or sensitive sites. Even if an account is private, route patterns and aggregated data can still create exposure in unexpected ways. 

The broader debate goes beyond one app. Fitness platforms profit from collecting valuable data, while users often assume their information stays personal. As regulators and security experts push for stronger protections, the Strava case shows that privacy in the connected fitness world depends on more than trust alone. It depends on design, defaults, and disciplined use.
Read more »
User Privacy
Chrome Extensions Data Breach Data Leak Linkedin User Privacy

LinkedIn Secretly Scans 6,000+ Chrome Extensions, Collects Device Data

 

LinkedIn is facing renewed scrutiny after a report alleged that its website secretly scans browsers for more than 6,000 Chrome extensions and collects device data tied to user profiles . The company says the detection is meant to identify scraping and other policy-violating extensions, not to infer sensitive personal information.

LinkedIn’s critics say the practice goes far beyond basic security checks because the platform can connect extension data to real identities, employers, and job roles. That makes the scanning especially controversial, since the results could reveal which tools workers or companies use, including products that compete with LinkedIn’s own sales offerings.

BleepingComputer said it independently confirmed part of the behavior during testing, observing a LinkedIn-loaded JavaScript file with a randomized name that checked for 6,236 browser extensions . The script reportedly did this by probing extension-related file resources, a known method for determining whether specific extensions are installed . 

The report also says the script gathers broader browser and device details, including CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio information, and storage features . That kind of data can contribute to browser fingerprinting, which may allow websites to build a more unique profile of a visitor across sessions . 

LinkedIn, however, rejects the allegation that it is using the data to profile users in a harmful way . The company says it looks for extensions that scrape data without consent or violate its terms, and that it uses the findings to improve defenses and protect site stability . The dispute also appears to be tied to a broader legal fight involving a LinkedIn-related browser extension developer, with LinkedIn pointing to a German court ruling that sided with the company .
Read more »
User Privacy
Cyber Fraud Microsoft 365 phishing Sophisticated Attack User Privacy

Microsoft 365 Phishing Bypasses MFA via OAuth Device Codes

 

A recent wave of phishing attacks is bypassing traditional security protections on Microsoft 365, even when multi‑factor authentication (MFA) is enabled. Instead of stealing passwords directly, attackers are abusing legitimate Microsoft login flows to trick users into granting access to their own accounts, effectively sidestepping the security codes that many organizations rely on for protection. These campaigns have already compromised hundreds of organizations, highlighting how modern phishing has evolved beyond simple fake login pages into sophisticated, session‑based attacks. 

The core technique leverages Microsoft’s OAuth 2.0 device authorization flow, a feature designed for devices like printers and TVs that cannot display a full browser. Users receive a phishing email or SMS that looks like a legitimate Microsoft prompt, often claiming that a “secure authorization code” must be entered on a Microsoft login page. When the victim goes to the real Microsoft domain and inputs the code, they quietly grant an attacker‑controlled application long‑lived OAuth tokens that provide full access to their Microsoft 365 mailbox, OneDrive, and Teams. 

Because the login happens on an actual Microsoft site, common phishing filters and user instincts often fail to detect anything unusual. The attacker never needs to capture a password or intercept an SMS code; they simply harvest the access and refresh tokens issued by Microsoft after the user completes MFA. This means that even changing passwords or waiting for a code to expire does not immediately cut off the attacker, since the stolen tokens can persist for extended periods unless explicitly revoked. 

From there, threat actors typically move laterally inside the environment, reading sensitive emails, staging more phishing messages to contacts and colleagues, and sometimes preparing for business email compromise or invoice fraud. In some cases, compromised accounts are used to send follow‑up phishing emails that appear to come from within the organization, making them harder to flag and more likely to succeed. This “inside‑out” style of attack undermines trust in internal communications and can significantly slow down detection and response. 

To counter these threats, organizations must go beyond standard MFA and focus on identity‑centric protections, including conditional access policies, risky‑sign‑in monitoring, and regular review of granted OAuth applications. Users should be trained to treat any unexpected authorization or device‑code request as suspicious, especially if they did not initiate a login, and to report such messages immediately. Combining strong technical controls with continuous security awareness remains the most effective way to reduce the risk of these advanced phishing campaigns on Microsoft 365.
Read more »
Subscribe to: Posts (Atom)