Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label cybersecurity news. Show all posts

Google Moves Forward with Chrome Phase-Out Impacting Billions

 


Despite the ripples that Google has created in the global tech community, the company has announced that its long-promised privacy initiative for Chrome is being discontinued. In a move that has shocked the global tech community, Google has ended one of the most ambitious projects of its life, one in which it hoped to reinvent the world of online privacy. 

In the wake of years of assurances and experiments, the company is officially announcing that the company will be phasing out its Privacy Sandbox project, once hailed as a way to eradicate invasive tracking cookies. There have been over three billion Chrome users since Chrome was launched, and many of them were expecting a safer, more private browsing experience. This decision marks a significant shift for Chrome. 

In the beginning, the Privacy Sandbox was introduced with the goal of bringing about an “even more private web” while maintaining a delicate balance between user protection and the advertising industry's needs for data collection. Despite Google's six-year plan, which was criticised by regulators and encountered numerous technical difficulties, the company has admitted that the program failed to provide a viable alternative to third-party cookies. This news is in response to recent warnings from Apple and Microsoft regarding Google Chrome, both of which cautioned against relying on the application due to concerns regarding privacy and security.

Google's vision of a privacy-first web seems to have faltered in light of this latest development — leaving many users and industry observers wondering what is going to happen to online tracking, digital advertising, and the world's most popular browser in the next five years. In the year 2024, Google embarked upon a transformative endeavour, redefining digital advertising and user privacy for the next generation of users. 

A tech giant operated by Alphabet, under its parent company, announced plans to phase out third-party cookies from Chrome - a cornerstone of online tracking for decades - and replace them with an improved Privacy Sandbox framework. Specifically, this initiative was created to understand user preferences without the invasive cross-site tracking that has long fueled personalised advertising campaigns. 

Among Google's objectives was twofold: to ensure privacy standards and maintain the profitable precision of targeted ads, which drive substantial revenue for the company. The Privacy Sandbox, which was launched in 2019, was a major architectural change in the way online ads were delivered. Instead of being reliant on external tracking servers for data processing and ad selection, users' browsers and devices were responsible for processing data and displaying ads.

3The project, however, despite years of testing and global scrutiny, did not produce a viable alternative to third-party cookies, which was the reason Google eventually decided to cease its six-year experiment by formally discontinuing the Privacy Sandbox earlier this year. As a quiet acknowledgement of the difficulty of balancing privacy and profits, the company officially ceased the experiment earlier this year. 

Despite the prospect of extensive tracking and customised ad targeting once again facing Chrome users, the browser's dominance over the global market does not appear to be declining. Chrome still holds more than 70 per cent of the browser market share across both mobile and desktop platforms, making it the leading browsing tool in the world. 

Even so, Google's leadership understands the shifting currents in the industry. With the advent of emerging AI-enabled browsers, such as Perplexity's Comet and an anticipated release from OpenAI, users are beginning to redefine what their online experience should be, as people move towards a more social and mobile experience. 

A critical inflexion point has been reached when Google decided to discontinue the Privacy Sandbox, which has been at the forefront of the ongoing debate around privacy and data-driven advertising since the 1990s. As a method of replacing third-party cookies with more privacy-conscious alternatives, the project was introduced with the intention of enabling advertisers to gain insight into users' interests without invasive cross-site tracking. 

Having launched in 2019, the initiative is intended to make sure that user privacy expectations are balanced with the commercial imperatives of the advertising industry and the scrutiny of global regulators. Google confirmed that, on October 21, the Privacy Sandbox project will be phased out, ending one of the most ambitious privacy initiatives Google has ever undertaken, after years of trials, delays, and regulatory engagement. 

There was an apparent lack of industry adoption, as well as unresolved technical difficulties, that led to the discontinuation of several key components, including Federated Learning of Cohorts (FLoC), Attribution Reporting API, IP Protection, and Private Aggregation, for which the company cited limited industry adoption and unresolved technical concerns. 

Despite being in favour of third-party cookies, the decision effectively preserves them for the foreseeable future in an acknowledgement that the industry does not yet have an alternative that is safe, effective, and scalable. There was a strong role played by regulatory bodies like the UK's Competition and Markets Authority (CMA) and Information Commissioner's Office (ICO) in facilitating this outcome, by highlighting potential anticompetitive risks and urging a deeper examination of the technology's ramifications. 

In contrast to the CMA's request for additional time to review industry results, the ICO expressed disappointment but encouraged continued innovation towards privacy-first solutions in an attempt to combat the anticompetitive risks. There appears to be a deeper tension between privacy concerns and business imperatives, underlying this policy reversal. Privacy Sandbox had long been criticised by advertisers because of its lack of support for real-time campaign reporting and essential brand safety mechanisms. 

In the future, Google plans to provide users with greater control over how their data is handled rather than completely removing cookies—a compromise reflected in both the commercial and regulatory environments in which it operates. Marketers should be aware of the implications of this persistent usage of third-party cookies. 

While traditional tracking methods remain viable, the digital landscape continues to shift towards transparency and consent-based engagement in order to maintain customer relevance. Over half of marketers have already started testing cookie-free solutions as a response to upcoming restrictions, even though many still heavily rely on third-party data for their campaign execution in preparation for future restrictions. 

Businesses whose companies proactively adapt - by acquiring first-party data, engaging in contextual advertising, and using privacy-safe analytics - see tangible benefits. These include improvements in performance ranging from 10 per cent for large companies to 100 per cent for smaller firms. In the long run, the move challenges businesses to evolve their marketing ecosystems to keep up with the changing market. 

As a result of newsletters, loyalty programs, and interactive experiences, it is becoming increasingly important to develop first-party data strategies. Consent management systems have become increasingly popular to ensure transparency, compliance with regulations, and first-party data protection, in addition to ensuring regulatory compliance. 

In recent years, contextual targeting, universal IDs, and data cleaning rooms have become increasingly popular as tools to keep campaigns accurate without losing users' trust. Despite the fact that third-party cookies will always be part of the web's fabric for a while, the industry consensus is clear: the future of digital marketing lies in developing meaningful user relationships that are built upon consent, credibility, and respect for privacy. 

The next chapter of digital advertising will continue to be defined by the balance between personalisation and privacy, especially as AI-driven browsers such as Perplexity's Comet and OpenAI's upcoming offerings introduce new paradigms in user interaction. A wave of reactions has erupted across the technology and advertising industries since Google announced its decision to discontinue its privacy sandbox program, which reveals both frustration and resignation at the same time. 

The decision has been described by observers as a defining moment for digital privacy and online advertising in history. A recent report from PPC Land stated that Chrome kills most Privacy Sandbox technologies after adoption fails. The report also noted that nine of Google’s proposed APIs had been retired after years of limited adoption and widespread criticism. 

In an even more direct statement, Engadget declared that “Google has killed Privacy Sandbox.” According to media outlets, the company has come to a halt with its multi-year effort to reimagine web privacy after a multi-year effort. Despite these developments, Chrome's overwhelming dominance in the browser market has not been affected at all by them. Despite repeated controversies surrounding user tracking, Chrome still holds a dominant position on both the desktop and mobile markets. 

Although privacy concerns and regulatory scrutiny have been raised, its cookie-replacement initiative failed to deliver a meaningful impact on user loyalty. The reality is that in the coming years, emerging competition from AI-powered browsers such as Perplexity's Comet and an upcoming browser from OpenAI could eventually reshape this landscape. 

In response to this, Google has been accelerating its innovation within Chrome, integrating its Gemini artificial intelligence system to enhance browsing efficiency as well as counter rising rivalry. Several people have already criticised Gemini for its deeper integration of data, suggesting that instead of reducing user tracking, this deeper integration may actually result in a greater amount of tracking of users. This paradox highlights the complexity of the relationship between Google and privacy once again. 

A recent article from Gizmodo notes that Google has completely removed the Privacy Sandbox, so it appears the long-deferred plan has come to a halt somewhere along the way. Throughout the publication, it was mentioned that individualised user tracking was an integral part of the modern advertising-supported web, and even though the debate has lasted for many years, it still remains in place. 

A major reason for the enduring tension between Google and its users is that the company is simultaneously responsible for ensuring user privacy while also making an important contribution to the creation of the highly data-driven advertising ecosystem that the company is continuing to benefit from to this very day. 

It was widely feared that Google's elimination of cookies would only strengthen its competitive position, since it has unique control over both data and advertising infrastructure. This situation was described as a temporary pause rather than a permanent resolution by Search Engine Land. As a result of Google's retreat, the cookie chaos has been brought to an end for now, but it is unclear whether privacy-first advertising will last in the future.

There was a strong emphasis placed on the fact that the Privacy Sandbox was Google’s response to mounting privacy regulations and a backlash against cross-site tracking, but due to its complexity, slow adoption, and regulatory restrictions, it failed to achieve its full potential. Although the industry may find some relief in the short term by maintaining familiar advertising tools, there remain long-term challenges to overcome. 

Forbes noted that the discontinuation may bring some stability today, but more uncertainty tomorrow. Advertisers will continue to rely on tracking models as regulatory pressures tighten around the world. Almost six years after Google first promised to end third-party tracking, the web has remained much the same: users are still being monitored across many sites, and the promise of a truly privacy-protected digital experience has yet to come true. 

Currently, the industry finds itself in a difficult position - balancing the necessity of commercial growth with ethical responsibilities - as the next generation of AI-powered browsers threatens to upset the ecosystem once again with its ongoing disruptions. With Google's withdrawal of its once-celebrated Privacy Sandbox coming to a close, the digital ecosystem stands at a crossroads between convenience and conscience as it marks the end of a six-year experiment. 

The decision of the company highlights what remains to be an uncomfortable truth about the internet's economic engine: individual data trails still play a major role in its economic engine. Although the advertising industry is facing a turning point, it is an opportunity for businesses and advertisers to rethink their engagement strategies. The future lies in transparent and consent-driven marketing that creates meaningful value exchanges based on trust, consent, and meaningful transparency. 

Brands that proactively invest in first-party data ecosystems, privacy-friendly analytics, and contextual intelligence will not just ensure compliance but will also strengthen customer loyalty in the process. Throughout this evolution, regulators, developers, and marketers need to collaborate to design frameworks that respect privacy without stifling innovation, as the rise of artificial intelligence browsers and an increased awareness of the importance of privacy will make it more than a regulatory checkbox, but instead one of the defining features of a brand. 

Those who adapt early to the new digital transformation paradigm, incorporating ethical principles into their strategy from the beginning, will emerge as trusted leaders in the next chapter of digital transformation - where privacy is no longer an obstacle to be overcome, but a competitive advantage contributing greatly to the future success of the web.

Fake SIM Cards Fuel Cybercrime Surge as Eastern Uttar Pradesh Emerges Under Scrutiny

 

A quiet digital crisis is spreading across India. In the past three months, the Department of Telecommunications (DoT) has disconnected more than 6.1 million mobile numbers after uncovering large-scale fraudulent registrations. 

Investigators say eastern Uttar Pradesh has become a major centre for this growing network of fake SIM cards. The findings reveal how fake mobile connections are being used to power phishing calls, financial scams, and other forms of cybercrime. Government data shows that around 3.2 million fake SIM cards were traced to western Uttar Pradesh, while 1.6 million originated from the eastern region. These connections, officials say, often serve as digital weapons for organized criminal groups operating across India. 

To counter this threat, the government has launched the Sanchar Saathi portal (sancharsaathi.gov.in) and a companion mobile app. Through this platform, users can check all mobile numbers issued in their name using the “Know My Mobile Connections” feature. 

It allows them to identify unfamiliar numbers and report them for immediate action. Officials believe this initiative will help citizens monitor their telecom identities and reduce the misuse of personal data. By creating transparency between users and service providers, the government hopes to build stronger digital accountability. 

The Issue of Multiple SIM Cards 

During the nationwide verification exercise, authorities discovered that thousands of individuals possessed more than nine SIM cards. 

The DoT has now ordered these connections to be re-verified, warning that any unverified numbers will be blocked. Investigators say such cases often involve forged identity documents used by fraud networks to acquire SIM cards in bulk for illegal use. 

Experts Warn of a Larger Security Risk 

Cybercrime experts caution that fake SIM cards are not a minor irregularity but part of a much larger problem. They form the base of several online frauds, from financial theft to digital impersonation. 

Professor Triveni Singh, a well-known cybercrime expert and former IPS officer, explains, “SIM card fraud is not merely a local problem. It is a threat that cuts across personal financial safety and national security alike. Unless identity verification systems are made foolproof and strictly enforced, the risk will continue to grow.” 

His statement reflects the growing anxiety among cybersecurity professionals who see telecom identity fraud as a weak link that can be exploited by criminal networks and even foreign actors. 

A Call for Vigilance 

For ordinary citizens, the government’s findings serve as a reminder that their digital identities can be misused without their knowledge. 

A SIM card registered under someone’s name could be used to commit crimes, leading to serious legal and financial consequences. 

To prevent such misuse, officials are urging citizens to visit the Sanchar Saathi portal, verify their mobile numbers, and flag any they do not recognize. 

The process involves entering the mobile number, verifying with an OTP, and reviewing all active connections under the user’s name. Suspicious or unused numbers can be reported for deactivation. 

Looking Ahead 
 
The situation in Uttar Pradesh highlights a deeper issue within India’s telecom ecosystem. While the government’s new verification system marks a step forward, experts say its success depends on public awareness and regular participation. 

As digital fraud becomes more sophisticated, even one fake SIM card can be enough to compromise a person’s safety or reputation. Strengthening telecom verification and encouraging citizens to take responsibility for their digital presence are now crucial steps in protecting India’s connected future.

Fake npm Package Hijacks Postmark Emails in Supply Chain Breach

A single line of malicious code hidden in a counterfeit npm package has exposed potentially thousands of sensitive emails every day, raising fresh alarms about software supply-chain security. 

The package, uploaded to npm under the name postmark-mcp, impersonated the legitimate Model Context Protocol (MCP) server of email delivery service Postmark.

According to investigators at Koi Security, the attacker copied code from Postmark’s official GitHub repository, inserted a backdoor that BCC’d every outgoing message to an external email address, and released it on npm. The deception lasted through 15 versions of the package, with the backdoor introduced in version 1.0.16. During its brief circulation, it was downloaded approximately 1,500 times in a week. 

Koi Security estimates that at least 300 organisations may have integrated it into their workflows, unknowingly diverting between 3,000 and 15,000 emails daily to the attacker’s server. These could have included password resets, authentication codes, invoices, financial data, and internal business correspondence. 

Postmark confirmed the malicious package was unrelated to its own operations, stressing that its infrastructure remained uncompromised. In an advisory, the company urged anyone who had installed the npm module to delete it immediately, review email logs for unusual traffic, and reset credentials transmitted by email. 

Postmark added that only one known customer had used the compromised package. Koi Security’s co-founder, Idan Dardikman, described the incident as a “warning shot” for the wider MCP ecosystem. MCP enables AI assistants to connect with external services, including email servers, granting them broad system-level permissions. 

“We’re effectively giving god-mode access to code from developers we don’t know or trust,” he warned, highlighting how AI-driven automation can magnify risks when malicious packages slip through. 

The case underscores the ongoing dangers of typosquatting and open-source supply chain poisoning, where attackers publish lookalike packages to exploit developer oversight. 

Unlike sophisticated zero-day exploits, this breach required no advanced techniques only the community’s willingness to run unverified code. 

Security experts say the incident reinforces the need for tighter controls around dependency management, stricter verification of open-source modules, and stronger monitoring of automated workflows, particularly those linked with AI systems.

Zscaler Confirms Exposure in Salesloft-Linked Data Breach

 

Zscaler has confirmed that it is among the latest organizations to be impacted by a major supply chain attack exploiting the Salesloft Drift application, which integrates with Salesforce. 

According to the company, attackers managed to steal OAuth tokens tied to the third-party app, giving them access to Zscaler’s Salesforce environment. The security vendor explained that the compromised data mainly consisted of business-related information rather than sensitive personal or financial records. Specifically, the exposed details included names, work email addresses, job titles, phone numbers, location data, licensing and commercial details relating to Zscaler products, as well as plain-text content from certain customer support cases. However, Zscaler emphasized that no attachments, files, or images were accessed in the incident. 

Upon detecting the unauthorized activity, the company acted quickly by revoking the Drift app’s access and rotating other API tokens as a precaution. In addition, it claimed to have put in place new safeguards and strengthened protocols to reduce the likelihood of similar breaches in the future. 

While Zscaler noted that the incident appeared limited in scope and said there is no evidence so far of any misuse of the exposed data, it urged customers to exercise extra caution. The company warned that malicious actors could exploit the stolen information for phishing campaigns or social engineering attacks, and therefore advised clients to be vigilant about unsolicited emails, calls, or requests for confidential information. 

This breach is part of a wider campaign being tracked by security researchers as UNC6395, which is said to have compromised numerous Salesforce customer environments between August 8 and August 18. The attackers reportedly exfiltrated large volumes of customer data during that period, potentially affecting hundreds of organizations. 

More recently, it has also been revealed that the same campaign targeted a limited number of Google Workspace accounts through Salesloft Drift integrations, further underlining the scope of the threat. Given the scale and operational sophistication demonstrated, some experts have speculated that a nation-state threat actor could be behind the attacks. 

Zscaler’s disclosure follows similar admissions from other companies caught in the same campaign, highlighting the continuing risks posed by supply chain compromises in cloud-based business ecosystems.

Cybercrime Group Claims Theft of MailChimp Client Data

 

The Russian-speaking cybercrime group Everest says it has stolen a large trove of data from email marketing giant Mailchimp, but the company has denied any evidence of a security incident. Everest announced the alleged breach on its dark web leak site, claiming to possess a 767 MB database with 943,536 rows of information. 

The group said the stolen material includes internal company documents alongside a “wide variety” of customer data. However, cybersecurity analysts examining a sample of the leaked files found the contents less alarming than Everest’s claims suggest. According to reports, the dataset appears to be structured business information rather than highly sensitive internal records. 

The entries include domain names, corporate email addresses, phone numbers, locations, GDPR region tags, social media profiles, and hosting provider details. Many records also list the technology stacks used by the companies such as Shopify, WordPress, Amazon, Google Cloud, and PayPal, hinting that the information may have originated from a marketing or CRM export instead of Mailchimp’s core systems. 

In a statement to media, Mailchimp’s parent company Intuit said: “The security of our products and our customers’ data are among our highest priorities. We are aware of the claims regarding Intuit Mailchimp’s systems. Based on our investigation at this time, we have no evidence to suggest any security incidents or exfiltration of data from our systems.” 

What's about the Everest Group?

Active since late 2020, Everest has historically used a double-extortion model, encrypting victims’ data while threatening to leak it unless a ransom is paid. Past targets have included the Brazilian government and NASA. From late 2022 onward, the group has increasingly operated as an Initial Access Broker (IAB), selling access to compromised networks instead of deploying ransomware directly. 

Recently, it has acted more as a data broker, publishing stolen material from companies such as Coca-Cola, the Saudi Arabian Rezayat Group, and other high-profile organizations. While the true origin and sensitivity of the Mailchimp-linked dataset remain unconfirmed, security experts warn that even non-sensitive business data could be leveraged in phishing or social engineering campaigns.

Qantas Hit by Cyberattack Days After FBI Warning on Airline 2FA Bypass Threat

 

Just days after the FBI warned airlines about a surge in 2FA bypass attacks by the hacker group Scattered Spider, Australian airline Qantas has confirmed a major cybersecurity incident. The breach, which targeted a third-party platform used for customer service, has potentially exposed personal data—including names, emails, birth dates, and frequent flyer details—of up to six million customers. 

The attack exploited social engineering tactics, a signature method of Scattered Spider, where attackers impersonate staff to deceive IT help desks into granting unauthorized access. Brett Winterford of Okta described the group as a loosely organized, profit-driven collective that thrives on peer recognition and repeated attacks across successful sectors. In a July 4 statement, Qantas Group CEO Vanessa Hudson assured that no credit card, passport, or financial data was compromised, and Qantas’ core systems remain secure. 

The airline said it contained the breach on July 1 and is working with cybersecurity experts to complete a forensic investigation. Affected customers began receiving email notifications from July 3, with further updates promised on the exact data exposed. Hudson emphasized the company’s commitment to transparency and robust response efforts, saying, “We are treating this incredibly seriously and have implemented additional security measures.” 

Cybersecurity professionals, including ex-FBI agent Adam Marrè and OPSWAT's James Neilson, stressed the need for heightened vigilance in the aviation sector, especially during peak travel periods. Marrè urged organizations to strengthen supply chain defenses and advised consumers to verify all communications from airlines. 

Graylog’s Ross Brewer, a Qantas customer himself, noted that clear and precise communication from the airline is critical to avoiding unnecessary panic and maintaining public trust. With airlines holding vast stores of sensitive data, experts warn the industry is an increasingly attractive target for cybercriminals. The Qantas breach reinforces the FBI’s call for all sectors to evaluate their cybersecurity hygiene and response strategies without delay.

Encryption Drops While Extortion-Only Attacks Surge

 

Ransomware remains a persistent threat to organisations worldwide, but new findings suggest cybercriminals are shifting their methods. According to the latest report by Sophos, only half of ransomware attacks involved data encryption this year, a sharp decline from 70 per cent in 2023.  
The report suggests that improved cybersecurity measures may be helping organisations stop attacks before ransomware payloads are deployed. However, larger organisations with 3,001 to 5,000 employees still reported encryption in 65 per cent of attacks, possibly due to the challenges of monitoring vast IT infrastructures. 

As encryption-based tactics decrease, attackers are increasingly relying on extortion-only methods. These attacks, which involve threats to release stolen data without encrypting systems, have doubled to 6 per cent this year. Smaller businesses were disproportionately affected 13 per cent of firms with 100 to 250 employees reported facing such attacks, compared to just 3 per cent among larger enterprises.  

While Sophos highlighted software vulnerabilities as the most common entry point for attackers, this finding contrasts with other industry data. Allan Liska, a ransomware expert at Recorded Future, said leaked or stolen credentials remain the most frequently reported initial attack vector. Sophos, however, reported a drop in attacks starting with credential compromise from 29 per cent last year to 23 per cent in 2024 suggesting variations in data visibility between firms. 

The report also underscored the human cost of cyberattacks. About 41 per cent of IT and security professionals said they experienced increased stress or anxiety after handling a ransomware incident. Liska noted that while emotional tolls are predictable, they are often overlooked in incident response planning.

Russian APT28 Targets Ukraine Using Signal to Deliver New Malware Families

 

The Russian state-sponsored threat group APT28, also known as UAC-0001, has been linked to a fresh wave of cyberattacks against Ukrainian government targets, using Signal messenger chats to distribute two previously undocumented malware strains—BeardShell and SlimAgent. 

While the Signal platform itself remains uncompromised, its rising adoption among government personnel has made it a popular delivery vector for phishing attacks. Ukraine’s Computer Emergency Response Team (CERT-UA) initially discovered these attacks in March 2024, though critical infection vector details only surfaced after ESET notified the agency in May 2025 of unauthorised access to a “gov.ua” email account. 

Investigations revealed that APT28 used Signal to send a macro-laced Microsoft Word document titled "Акт.doc." Once opened, it initiates a macro that drops two payloads—a malicious DLL file (“ctec.dll”) and a disguised PNG file (“windows.png”)—while modifying the Windows Registry to enable persistence via COM-hijacking. 

These payloads execute a memory-resident malware framework named Covenant, which subsequently deploys BeardShell. BeardShell, written in C++, is capable of downloading and executing encrypted PowerShell scripts, with execution results exfiltrated via the Icedrive API. The malware maintains stealth by encrypting communications using the ChaCha20-Poly1305 algorithm. 

Alongside BeardShell, CERT-UA identified another tool dubbed SlimAgent. This lightweight screenshot grabber captures images using multiple Windows API calls, then encrypts them with a combination of AES and RSA before local storage. These are presumed to be extracted later by an auxiliary tool. 

APT28’s involvement was further corroborated through their exploitation of vulnerabilities in Roundcube and other webmail software, using phishing emails mimicking Ukrainian news publications to exploit flaws like CVE-2020-35730, CVE-2021-44026, and CVE-2020-12641. These emails injected malicious JavaScript files—q.js, e.js, and c.js—to hijack inboxes, redirect emails, and extract credentials from over 40 Ukrainian entities. CERT-UA recommends organisations monitor traffic linked to suspicious domains such as “app.koofr.net” and “api.icedrive.net” to detect any signs of compromise.