Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label User Privacy. Show all posts
User Privacy
Cyber Security Mass Surveillance Palantir Trump Administration User Privacy

US Government Secretly Builds Enormous Database Tracking Citizens

 

An explosive story regarding the Trump administration's collaboration with Palantir, which could result in the creation of a master database containing data on every American, was released by the New York Times last month. If such a "master list" was created, the Times claims, it would grant the president "untold surveillance power." 

President Donald Trump signed an executive order earlier this year allowing the federal government to exchange data on Americans among multiple organisations. However, we now have a better idea of how the administration plans to accomplish this. Trump has hired Palantir, a software startup co-founded by Trump and Republican megadonor Peter Thiel, to carry out these initiatives. 

According to the New York Times, Palantir's technology would allow for the compilation of sensitive information from agencies such as the Department of Homeland Security, Immigration and Customs Enforcement, and the Internal Revenue Service. Various government databases already have information on Americans' bank account numbers, medical claims, disabilities, student loan levels, and other details, though not in one location. 

In order to boost government efficiency and save hard-earned public cash, the Trump administration has stated that it wants to "eliminate information silos and streamline data collection across all agencies." The threat of a central database, however, is a nightmare for privacy advocates and has even prompted security and privacy worries from former Palantir staff members. 

Palantir controversial role

Despite its reputation for being extremely covert about its data mining and spying activities, Palantir positions itself as a data and analytics firm. Additionally, Palantir has been under fire for offering information services to support the Israeli military during the Israel-Hamas conflict in 2023. The IDF receives intelligence services from Palantir, as CEO Karp has previously revealed.

Palantir has responded by defending its collaboration with Israel and refuting claims that it is supporting war crimes, as its most vocal detractors claim. As part of the Trump Administration's contentious policing and deportation initiatives, Palantir has also been called upon to assist U.S. Immigration and Customs Enforcement (ICE) in tracking immigrants in the United States. 

Why would the Trump Administration use Palantir to acquire data?

Palantir has already been contracted by the federal government for several years. For example, Palantir previously collaborated with Health and Human Services to track the COVID-19 pandemic. However, Palantir's stock and revenue have soared since Trump's inauguration earlier this year. To date, the federal government has given Palantir around $113 million in 2025.

Furthermore, last week, Palantir was given a $795 million contract by the Department of Defence. In 2024, Palantir earned $1.2 billion from the U.S. government, according to the company's last quarterly report. Furthermore, Thiel, a co-founder of Palantir, is a key Republican fundraiser. In addition to giving $1.25 million to Trump's 2016 campaign, he has contributed tens of millions of dollars to Republican congressional campaigns over the years.
Read more »
User Security
Cyber Fraud Deepfakes Financial Scam User Privacy User Security

Deepfakes Explained: How They Operate and How to Safeguard Yourself

 

In May of this year, an anonymous person called and texted elected lawmakers and business executives pretending to be a senior White House official. U.S. senators were among the recipients who believed they were speaking with White House chief of staff Susie Wiles. In reality, though, it was a phoney. 

The scammer employed AI-generated deepfake software to replicate Wiles' voice. This easily accessible, low-cost software modifies a public speech clip to deceive the target. 

Why are deepfakes so convincing? 

Deepfakes are alarming because of how authentic they appear. AI models can analyse public photographs or recordings of a person (for example, from social media or YouTube) and then create a fake that mimics their face or tone very accurately. As a result, many people overestimate their ability to detect fakes. In an iProov poll, 43% of respondents stated they couldn't tell the difference between a real video and a deepfake, and nearly one-third had no idea what a deepfake was, highlighting a vast pool of potential victims.

Deepfakes rely on trust: the victim recognises a familiar face or voice, and alarms do not sound. These scams also rely on haste and secrecy (for example, 'I need this wire transfer now—do not tell anyone'). When we combine emotional manipulation with visual/auditory reality, it is no surprise that even professionals have been duped. The employee in the $25 million case saw something odd—the call stopped abruptly, and he never communicated directly with colleagues—but only realised it was a scam after the money was stolen. 

Stay vigilant 

Given the difficulty in visually recognising a sophisticated deepfake, the focus switches to verification. If you receive an unexpected request by video call, phone, or voicemail, especially if it involves money, personal data, or anything high-stakes, take a step back. Verify the individual's identity using a separate channel.

For example, if you receive a call that appears to be from a family member in distress, hang up and call them back at their known number. If your supervisor requests that you buy gift cards or transfer payments, attempt to confirm in person or through an official company channel. It is neither impolite or paranoid; rather, it is an essential precaution today. 

Create secret safewords or verification questions with loved ones for emergencies (something a deepfake impostor would not know). Be wary of what you post publicly. If possible, limit the amount of high-quality videos or voice recordings you provide, as these are used to design deepfakes.
Read more »
User Privacy
Business Security Cyber Security Document-Borne Malware Malicious Campaign User Privacy

Here's Why Businesses Need to be Wary of Document-Borne Malware

 

The cybersecurity experts are constantly on the lookout for novel tactics for attack as criminal groups adapt to better defences against ransomware and phishing. However, in addition to the latest developments, some traditional strategies seem to be resurfacing—or rather, they never really went extinct. 

Document-borne malware is one such strategy. Once believed to be a relic of early cyber warfare, this tactic remains a significant threat, especially for organisations that handle huge volumes of sensitive data, such as those in critical infrastructure.

The lure for perpetrators is evident. Routine files, including Word documents, PDFs, and Excel spreadsheets, are intrinsically trusted and freely exchanged between enterprises, often via cloud-based systems. With modern security measures focussing on endpoints, networks, and email filtering, seemingly innocuous files can serve as the ideal Trojan horse. 

Reasons behind malicious actors using document-borne malware 

Attacks utilising malicious documents seems to be a relic. It's a decades-old strategy, but that doesn't make it any less detrimental for organisations. Still, while the concept is not novel, threat groups are modernising it to keep it fresh and bypass conventional safety procedures. This indicates that the seemingly outdated method remains a threat even in the most security-conscious sectors.

As with other email-based techniques, attackers often prefer to hide in plain sight. The majority of attacks use standard file types like PDFs, Word documents, and Excel spreadsheets to carry malware. Malware is typically concealed in macros, encoded in scripts like JavaScript within PDFs, or hidden behind obfuscated file formats and layers of encryption and archiving. 

These unassuming files are used with common social engineering approaches, such as a supplier invoice or user submission form. Spoofed addresses or hacked accounts are examples of email attack strategies that help mask malicious content. 

Organisations' challenges in defending against these threats 

Security analysts claim that document security is frequently disregarded in favour of other domains, such as endpoint protection and network perimeter. Although document-borne attacks are sufficiently commonplace to be overlooked, they are sophisticated enough to evade the majority of common security measures.

There is an overreliance on signature-based antivirus solutions, which frequently fail to detect new document-borne threats. While security teams are often aware of harmful macros, formats such as ActiveX controls, OLE objects, and embedded JavaScript may be overlooked. 

Attackers have also discovered that there is a considerable mental blind spot when it comes to documents that appear to have been supplied via conventional cloud-based routes. Even when staff have received phishing awareness training, there is a propensity to instinctively believe a document that arrives from an expected source, such as Google or Office 365.

Mitigation tips 

As with other evolving cyberattack strategies, a multi-layered strategy is essential to defending against document-borne threats. One critical step is to use a multi-engine strategy to malware scanning. While threat actors may be able to deceive one detection engine, using numerous technologies increases the likelihood of detecting concealed malware and minimises false negatives. 

Content Disarm and Reconstruction (CDR) tools are also critical. These sanitise and remove malicious macros, scripts, and active material while keeping the page intact. Suspect files can then be run through enhanced standboxes to detect previously unknown threats' malicious behaviour while in a controlled environment. 

The network should also be configured with strict file rules, such as limiting high-risk file categories and requiring user authentication before document uploads. Setting file size restrictions can also help detect malicious documents that have grown in size due to hidden coding. Efficiency and dependability are also important here. Organisations must be able to detect fraudulent documents in their regular incoming traffic while maintaining a rapid and consistent workflow for customers.
Read more »
User Privacy
Data Breach Data Leak Logistics Firm Noida Firm User Privacy

FIR Filed After Noida Logistics Company Claims User Data Leaked

 

High-profile clients' private information, including that of top government officials, was leaked due to a significant cybersecurity incident at Agarwal Packers and Movers Ltd (APML) in India. Concerns over the security of corporate data as well as possible national security implications have been raised by the June 1 incident. An inquiry is still under progress after police filed a formal complaint. 

In what could be one of the most sensitive data breaches in recent memory, Agarwal Packers and Movers Ltd (APML), a well-known logistics company with its headquarters located in Sector 60, Noida, has disclosed that private client information, including the addresses and phone numbers of senior government clients, has been stolen. 

The intrusion was detected on June 1 after several clients, including prominent bureaucrats, diplomats, and military people, began receiving suspicious, highly targeted phone calls.

"The nature of the calls strongly indicated that the callers had access to specific customer queries and records related to upcoming relocations," the complainant, Jaswinder Singh Ahluwalia, Group President and CEO of APML, stated in the police FIR. He cautioned that this is more than just a disclosure of company data. It has an impact on personal privacy, public trust, and possibly national security. 

The company initiated an internal technical inspection, which uncovered traces of unauthorised cyber infiltration, confirming worries regarding a breach. The audit detected collaboration between internal personnel and external cybercriminals. While the scope of the hack is still being investigated, its significance is undeniable: the firm serves India's elite, making the stolen data a potential goldmine for bad actors. 

In accordance with Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita and Sections 66C (identity theft) and 66D (impersonation by computer resource) of the Information Technology Act, a formal complaint was filed at the Sector 36 Cyber Crime Police Station. 

According to Cyber SHO Ranjeet Singh, they have a detailed complaint with technological proof to back it up. At the moment, their cyber unit is looking through access trails, firewall activity, and internal server records. Due to the nature of clients impacted, the issue is being handled with the highest attention. 

The attack has triggered calls for stricter cybersecurity practices in private companies that serve sensitive sectors. While APML has yet to reveal how many people were affected, its internal records allegedly include relocation information for high-level clientele like as judges, intelligence officers, and foreign dignitaries.
Read more »
User Security
Cyber Fraud Helpdesk Scam IT Fraud User Privacy User Security

The Rise in IT Helpdesk Scams: What Can Users Do?

 

Over 37,500 complaints concerning phoney tech-support scams were filed in the United States last year alone, resulting in losses of over $924 million, according to the latest FBI's Internet Crime Report. 

In this piece, we'll look at how these scams work, the risks they bring, and how you can prevent them. 

Modus operandi

In this scheme, scammers generally mimic technical or customer-service representatives from prominent corporations, most often in the tech industry. This allows fraudsters to utilise impressive-sounding phrases and technical information that the common user cannot understand.

The most typical pretext used by fraudulent tech-support scammers to contact potential victims is claiming to have discovered a problem with the latter's computer. For example, fake employees of a software developer or a well-known antivirus company call you and tell you that they have discovered malware on your computer, you should be suspicious. 

Scammers therefore overwhelm their victims, creating panic and a sense of helplessness. The fraudsters then use these emotions to gain trust; these techniques are typically designed to make the victim feel compelled to trust them. It is this trust that the scammers ultimately use to achieve their objectives. 

Prevention tips

If someone approaches you claiming to be from tech support, warns you of a danger, and insists that action be taken immediately, it is most certainly a fake tech-support fraudster. Try not to panic and avoid doing anything you'll regret later.

It is preferable to share what is going on with someone else, as this might help you discover inconsistencies and flaws in the scammer's story. To buy time, tell them you're busy, have another call, your phone's battery is running low, or simply pretend to be disconnected. Furthermore, to protect yourself from scammers, you can take the following steps: 

  • Install a reputable security solution on all of your devices and heed its warnings. 
  • Never enter your login information while someone else is viewing, such as while screen sharing or when someone has remote access to your computer. 
  • Avoid installing remote access software on your computer, and never provide access to outsiders. By the way, our protection can alert you to such threats.

It's also worth noting that the elderly are particularly prone to tech support frauds. They may not be very cyber-savvy, therefore they want reliable security more than anyone else.
Read more »
User Privacy
Mobile Security SMS Code threat report two-factor authentication User Privacy

Here's Why Using SMS Two-Factor Authentication Codes Is Risky

 

We've probably all received confirmation codes via text message when trying to enter into an account. These codes are intended to function as two-factor verification, confirming our identities and preventing cybercriminals from accessing our accounts solely through a password. But who handles the SMS codes, and can they be trusted? 

 New findings from Bloomberg and the collaborative investigative newsroom Lighthouse findings offer insight on how and why text-based codes might put people in danger. In their investigations, both organisations stated that they got at least a million data packets from a phone company whistleblower. Individual users got the packets, which contained SMS texts with two-factor authentication codes. 

You may believe that these messages are handled directly by the companies and websites with which you have an account. However, Bloomberg and Lighthouse's investigation suggests that this is not always the case. In this case, the messages went through a contentious Swiss company called Fink Telecom Services. And Bloomberg used the label "controversial" to describe Fink for a reason. 

"The company and its founder have worked with government spy agencies and surveillance industry contractors to surveil mobile phones and track user location. Cybersecurity researchers and investigative journalists have published reports alleging Fink's involvement in multiple instances of infiltrating private online accounts,” Bloomberg reported. 

Of course, Fink Telecom didn't exactly take that and other comments lying down. In a statement shared with ZDNET, Fink called out the article: "A simple reading of this article reveals that it presents neither new findings nor original research," Fink noted in its statement. "Rather, it is largely a near-verbatim repetition of earlier reports, supplemented by selective and out-of-context insinuations intended to create the appearance of a scandal-without providing any substantiated factual basis.”

Bloomberg and Lighthouse discovered that the senders included major tech companies including Google, Meta, and Amazon. Several European banks were also involved, as were applications like Tinder and Snapshot, the Binance cryptocurrency market, and even encrypted communication apps like Signal and WhatsApp. 

Why would businesses leave their two-factor authentication codes to an outside source, especially one with a questionable reputation? Convenience and money. External contractors can normally handle these types of SMS messages at a lower cost and with greater ease than enterprises themselves. That is especially true if a company has to interact with clients all around the world, which can be complicated and costly. 

Instead, firms turn to providers like Fink Telecom for access to "global titles." A global title is a network address that allows carriers to interact between countries. This makes it appear that a company is headquartered in the same country as any of its consumers. 

According to Lighthouse's investigation, Fink utilised worldwide titles in Namibia, Chechnya, the United Kingdom, and his native Switzerland. Though outsourcing such messages can be convenient, it carries risks. In April, UK phone regulator Ofcom banned global title leasing for UK carriers, citing the risk to mobile phone users. 

The key issue here is whether the data in the documents examined by Bloomberg and Lighthouse was ever at risk. In an interview with Bloomberg, Fink Telecom CEO Andreas Fink stated: "Our company offers infrastructure and technical services, such as signalling and routing capabilities. We do not analyse or meddle with the traffic sent by our clients or their downstream partners. 

Fink further shared the following statement with ZDNET: "Fink Telecom Services GmbH has always acted transparently and cooperatively with the authorities," Fink said. "Legal opinions and technical documentation confirm that the company's routing services are standardized, internationally regulated, and do not require authorization under Swiss telecommunications law, export control law, or sanctions legislation. Authorities were also informed that the company is in no way involved in any misuse of its services.”

In terms of outsourcing, Google, Meta, Signal, and Binance informed Bloomberg that they did not deal directly with Fink Telecom. Google also stated that it was discontinuing the use of SMS to authenticate accounts, although Signal stated that it provided solutions to SMS vulnerabilities. A Meta representative told Bloomberg that the company has warned its partners not to do business with Fink Telecom.
Read more »
User Privacy
Insikt Group malware Mozambique Predator spyware User Privacy

Predator Spyware Campaign Resurfaces With a New Infrastructure

 

The latest discovery of new Predator spyware-related equipment suggests that the surveillance technology is still finding new clients, despite US penalties imposed on its backers since July 2023. 

In a report published earlier this month, analysts at Insikt Group claimed to have traced the sophisticated malware to operators in Mozambique for the first time. According to Insikt, Mozambique is one of many African countries where the spyware has spread, with the continent home to more than half of all known Predator users.

According to Insikt, a new discovery in the probe revealed "the first technical connection made between Predator infrastructure and corporate entities associated with the Intellexa Consortium," referring to the group believed to be backing Predator. The United States sanctioned several entities, including Intellexa.

The disclosure stems from an Insikt investigation into entities associated with Dvir Horef Hazan, a Czech bistro owner, entrepreneur, and programmer who, according to a Czech news source, worked for Intellexa. A Greek law enforcement investigation into the alleged Predator targeting of journalist Thanasis Koukakis revealed that Intellexa moved over €3 million (around $3.5 million) to Hazan and his businesses. 

The details of Hazan's alleged work for Intellexa are unclear, but Insikt claims to have identified a link between Predator's multi-tiered architecture and a Czech company that is indirectly tied to Hazan.

The researchers claim that Predator's basic infrastructure has stayed mostly unaltered, however there is evidence that operators have modified the spyware to make it trickier to detect on a device. Insikt's recent data support previous reports that Predator activities continued following the US government's steps in July 2023. 

Initially, the Commerce Department placed Intellexa and a subsidiary unit, Cytrox, on the Entity List, which limits how companies conduct business with the United States and tarnish their reputation. Then, in 2024, federal agencies acted twice to ban Predator-related organisations.
Read more »
User Privacy
Acoustic Attack Air-Gapped System Cyber Attacks smartwatch User Privacy

Smartwatches: New Air-Gapped System Assault Vehicle

 

A novel assault identified as 'SmartAttack' leverages smartwatches as a covert ultrasonic signal receiver to extract data from physically isolated (air-gapped) devices.

Air-gapped systems, which are often used in mission-critical environments such as government buildings, weapons platforms, and nuclear power plants, are physically separated from external networks to prevent malware infestations and data theft. Despite their isolation, they are still susceptible to compromise from insider threats like rogue employees utilising USB devices or state-sponsored supply chain attacks. 

Once infiltrated, malware can function silently, modulating the physical features of hardware components to communicate sensitive data to a nearby receiver without interfering with the system's regular operations. 

SmartAttack was developed by Israeli university researchers led by Mordechai Guri, a covert attack channel expert who has previously shown ways for leaking data using LCD screen noise, RAM modulation, network card LEDs, USB drive RF signals, SATA connectors, and power supply. While assaults on air-gapped environments are often theoretical and exceedingly difficult to execute, they do present interesting and unique ways to exfiltrate data. 

Modus operandi

SmartAttack requires malware to infect an air-gapped machine in order to acquire sensitive data such as keystrokes, encryption keys, and credentials. It can then use the computer's built-in speaker to send ultrasonic signals into the environment. The audio signal frequencies can be modified using binary frequency shift keying (B-FSK) to represent binary data, also known as ones and zeros. A frequency of 18.5 kHz symbolises "0," whereas 19.5 kHz represents "1.”

Humans cannot hear frequencies in this range, but they can be picked up by a smartwatch microphone worn by someone close. The smartwatch's sound monitoring app uses signal processing to detect frequency shifts and demodulate encoded signals, as well as integrity tests. The final data exfiltration can occur via Wi-Fi, Bluetooth, or cellular connectivity. 

Performance and limitations 

The researchers point out that smartwatches use smaller, lower-SNR microphones than smartphones, making signal demodulation challenging, particularly at higher frequencies and lower signal intensities. Even wrist position was discovered to be a significant factor in the attack's feasibility, with the watch operating best when it is in "line-of-sight" with the computer speaker. 

The maximum transmission range varies per transmitter (speaker type) and is between 6 and 9 meters (20 - 30 feet). Data transmission rates range from 5 to 50 bits per second (bps), with dependability decreasing as rate and distance rise. Prohibiting smartwatch use in safe settings is the best method to combat the SmartAttack, according to the researchers. 

Eliminating the built-in speakers from air-gapped devices would be an additional step. This would remove the attack surface for not just SmartAttack but all acoustic covert routes. If none of this is practical, ultrasonic jamming using software-based firewalls, audio-gapping, and wideband noise emission may still work.
Read more »
User Privacy
Cloud Security Cyber Security data security threat report User Privacy

Data Security Posture Insights: Overcoming Complexity and Threat Landscape

 

In today's competitive landscape, it is becoming more critical for businesses to find ways to adapt their data security, governance, and risk management strategies to the volatile economy by increasing efficiency or lowering costs while maintaining the structure, consistency, and guidance required to manage cyber threats and ensure compliance. 

As organisations increasingly migrate various on-premises applications and data workloads to multicloud environments, the complexity and dispersed nature of cloud environments presents significant challenges in terms of managing vulnerabilities, controlling access, understanding risks, and protecting sensitive data.

What is data security risk? 

Data security refers to the process of preserving digital information from unauthorised access, corruption, or theft throughout its lifecycle. Risks are introduced into databases, file servers, data lakes, cloud repositories, and storage devices via all access channels to and from these systems. 

Most importantly, the data itself, whether in motion or at rest, deserves the same level of protection. When effectively executed, a data-centric approach will secure an organization's assets and data from cyberattacks while also guarding against insider threats and human error, which are still among the major causes of data breaches.

Complexity factor into data security risk 

Many variables contribute to organisational growth while also increasing security complexity. Complexity undermines operational stability and has an equivalent influence on security. Understanding and analysing all the causes of complexity allows organisations to develop focused initiatives and efficiently automate observability and control, fostering a lean and responsive operational team. 

Cloud Security Alliance's Understanding Data Security Risk 2025 Survey Report outlines major topics that organisations are actively addressing:

High growth with AI-driven innovation and security: As AI stimulates innovation, it also broadens the threat landscape. Rapid expansion frequently outpaces the creation of required infrastructures, processes, and procedures, resulting in ad hoc measures that add complexity. Gen-AI also introduces a new level of difficulty as it becomes more prominent in cloud environments, which remain a major target owing to their complexity and scale. 

Processes and automation: We understand that limited staff and inefficient or outdated processes frequently result in manual and redundant efforts. This places a significant load on teams that struggle to stay up, resulting in reactive stopgap or workaround actions. To summarise, manual efforts can be error-prone and time-consuming. At the same time, organisations may encounter unwanted bottlenecks, which can increase complexity and impede risk detection and security enforcement. Automate as much as possible, including data security and risk intelligence, to ensure that risks are managed proactively, reducing the escalation of critical occurrences. 

Technology integration: Although technology provides answers for efficiency and effectiveness, integrating several systems without careful planning can result in disjointed security process silos, ineffective security infrastructure, and mismatched security stack components. Fragmented visibility, control, and access enforcement are the unstated costs of fragmented tools. Even though they are crucial, traditional compliance and security systems frequently lack the integration and scalability required for contemporary and successful risk management. 

Proactive data security posture management 

To improve security posture, organisations are adopting proactive, risk-based solutions that include continuous monitoring, real-time risk assessments, and dynamic actionable workflows. This strategy allows for the detection and mitigation of flaws before they are exploited, resulting in a more strong defence against threats. 

According to the poll results, 36% prioritise assessment results, 34% believe a dedicated dashboard is most useful, and 34% want risk scores to better understand their organization's data risk. 

 onquering complexity necessitates a comprehensive approach that incorporates technology, best practices, and risk awareness. By prioritising data security throughout your cloud journey, you can keep your data safe, your apps running smoothly, and your business thriving in the ever-changing cloud landscape.
Read more »
User Privacy
Juice Jacking Mobile Security Travel Security TSA User Privacy

TSA Advises Against Using Airport USB Ports to Charge Your Phone

 

So-called juice jacking is the most controversial topic in cybersecurity circles. In most years, when a new alert is issued by a government agency before the holidays, it creates new headlines. Stories are written and cyber eyebrows are raised — there are more stories than attacks. But still those stories come. However, a recent alert raises the possibility that travellers may actually be at risk.

In reality, juice jacking occurs when you plug your phone into a public charging cable or socket at a hotel or airport, and rather than a dumb charger, a computer operates in the background to retrieve data from your device. This is not the same as carefully designed attack cables that contain a malicious payload inside the cable.

The latest official warning (and headlines 1,2) comes from the TSA. "When you're at an airport, do not plug your phone directly into a USB port," it warns you. "Bring your TSA-compliant power brick or battery pack and plug in there." This is so because "hackers can install malware at USB ports (we've been told that's called 'juice/port jacking').” 

TSA also urges smartphone users not to use free public WiFi, especially if they intend to make any online purchases. Do not enter any sensitive information while using unsecure WiFi. Cyber experts are almost as divided on the public WiFi hijacking problem as they are on juice-jacking. TL;DR: While it compromises your location, all encrypted data transmitted to or from your device via websites or apps should be secure.

The greater risk is downloading an app from the malicious access point's splash page, filling online forms, or being routed to bogus login sites for Microsoft, Google, or other accounts. The typical advice applies: use passkeys, avoid logging in to linked or popup windows and instead utilise the traditional channels, and do not reveal personal information. You should also be cautious about which WiFi hotspots you connect to - are they legitimate services from the hotel, airport, or mall, or are they cleverly labelled fakes? 

This is more of an issue for Android than iOS, but it isn't something most people need be concerned about. However, if you believe you may be the target of an attack or if you travel to high-risk areas of the world, I strongly advise against utilising public charging outlets or public WiFi without some type of data protection.
Read more »
User Privacy
Data Facebook Meta Social Media Technology User Privacy

Want to Leave Facebook? Do this.

Want to Leave Facebook? Do this.

Confused about leaving Facebook?

Many people are changing their social media habits and opting out of many services. Facebook has witnessed a large exodus of users deserting the platform after the announcement in March that Meta was terminating the independent fact-checking on its platform. However, fact-checking has been replaced with community notes, letting users make changes to potentially false/misleading information. 

Users having years of photos and posts on Facebook are confused about how to collect their data before removing their accounts. If you also feel the same problem, this post will help you delete Facebook permanently, while taking all your information on the way out. 

How to remove Facebook?

For users who do not want to be on Facebook anymore, deleting their account is the only way to completely remove yourself from the platform. If you are not sure, deactivating your account allows you to have some life off of Facebook without account deletion. 

Make sure to remove third-party Facebook logins before deleting your account. 

How to leave third-party apps?

Third-party apps like DoorDash and Spotify allow you to log in using your Facebook account. This lets you log in without remembering another password, but if you’re planning on deleting Facebook, you have to update your login settings. That is because if you delete your account, there will not be another Facebook account for the user to log in through. 

Fortunately, there is another simple way to find which of your sites and applications are connected to Facebook and delete them before removing your account. Once you disconnect from other websites and applications from Facebook, you will need to adjust how you login to them. 

Users should try specific applications and websites to set new passwords or passkeys or log in via a single-service sign-on option, such as Google. 

How is deactivating different than deactivating a Facebook account?

If you want to stay away from Facebook, you have two choices. Either delete your account permanently, or you can disable it temporarily to deactivate it. 

Read more »
User Privacy
Adidas Data Breach Data Leak Third-party breach User Privacy

Adidas Confirms Data Leak After User Service Provider Hack

 

Adidas confirmed that a third-party customer service provider's vulnerability allowed a threat actor to steal company data. 

Contact details of customers who have previously dealt with the Adidas customer service help desk are among the impacted data. However, passwords, credit cards, and other financial or payment information are not included.

"Adidas is in the process of informing potentially affected consumers as well as appropriate data protection and law enforcement authorities consistent with applicable law," the company explained in a notification on its website. 

It has subsequently initiated an investigation to gather facts about a breach and is working with information security professionals. Adidas did not reveal the name of its third-party customer support provider. It also remains unknown who carried out the strike. 

"This incident underscores a critical truth: third-party breaches swiftly become your organization's breaches, which highlights the necessity of robust oversight mechanisms," noted Fletcher Davis, senior security research manager at BeyondTrust. "Mandating security assessments, multifactor authentication, and zero-trust architecture for all vendor access, while deploying real-time identity infrastructure monitoring to cut response times to minutes, as opposed to days.” 

Adidas is not the first well-known brand to have experienced data leaks or cyberattacks in recent years. Recent ransomware attacks have targeted the Co-op Group, Marks & Spencer, and the luxury shop Harrods. Marks & Spencer reported that its customers' personal information was stolen during the incident, and that retail operations had been affected.

Scattered Spider was possibly responsible for the attack, unleashing DragonForce ransomware against the UK retailer, forcing Marks & Spencer to estimate a $400 million hit on earnings.

Establishing strong defense 

Forward-thinking merchants are implementing new techniques to mitigate third-party risk. Consider the following best practices: 

Zero trust approach: Treat every provider as a potential risk and restrict data access to what is absolutely essential. 

Incident simulation: Conduct regular exercises that simulate third-party breaches and test your response procedures. 

Continuous vendor assessment: Use automated systems to track vendor security status all year, not just during annual audits. 

The Adidas breach was not an isolated incident. It is a warning to the entire retail sector. As hackers become more adept, businesses must consider third-party risk as a key priority rather than just a compliance concern.
Read more »
User Privacy
Cyber Attacks MathWorks MATLAB Ransomware attack User Privacy

MathWorks Hit by Ransomware Attack Affecting Over 5 Million Clients

 

The renowned MATLAB programming language and numeric computing environment's developer has reported a ransomware attack on its IT systems. 

MathWorks, based in Massachusetts, sent an update to users after initially reporting issues on May 18, stating that the company had been hit by a ransomware attack that shut down online services and internal systems used by employees. 

“We have notified federal law enforcement of this matter,” the company noted. “We have brought many of these systems back online and are continuing to bring other systems back online with the assistance of cybersecurity experts.” 

MathWorks has millions of users, including engineers and scientists who use MATLAB for data analysis, calculation, and other purposes. MATLAB and other MathWorks products are utilised by nearly 6,500 colleges and universities, according to the company.

The firm has 6,500 employees and over 30 offices in Europe, Asia, and North America. This issue affected several MATLAB services as well as parts of the MathWorks website, such as the job page, cloud centre, store, and file exchange. MATLAB Online and MATLAB Mobile were restored on Friday.

MathWorks stated in a Tuesday update that the issue was still being investigated. Several pages on the MathWorks website are still offline. The firm did not immediately respond to a request for comment. 

Verizon's comprehensive data breach report released last month revealed that ransomware was utilised in nearly half of the 12,195 confirmed data breaches in 2024. The researchers discovered that 64% of ransomware victims did not pay the ransoms, up from 50% two years ago, and the typical amount paid to ransomware groups has dropped to $115,000 (down from $150,000 last year). 

“This could be partially responsible for the declining ransom amounts. Ransomware is also disproportionately affecting small organizations,” the researchers noted. “In larger organizations, ransomware is a component of 39% of breaches, while small and medium-sized businesses experienced ransomware-related breaches to the tune of 88% overall.” 

The number of large ransoms paid has also reduced, with Verizon estimating that 95% of ransoms paid will be less than $3 million by 2024. That value is a significant increase above the $9.9 million recorded in 2023.
Read more »
Vietnam
Data Leak Illicit Activity Mobile Security Telegram User Privacy Vietnam

Vietnam Blocks Telegram Messaging App

 

Vietnam's technology ministry has ordered telecommunications service providers to ban the messaging app Telegram for failing to cooperate in the investigation of alleged crimes committed by its users, a move Telegram described as shocking.

In a document dated May 21 and signed by the deputy head of the telecom department at the technology ministry, telecommunications firms were asked to start steps to block Telegram and report back to the ministry by June 2. 

In the document seen by Reuters, the ministry was acting on behalf of the nation's cybersecurity department after police revealed that 68% of Vietnam's 9,600 Telegram channels and groups were breaking the law. They cited drug trafficking, fraud, and "cases suspected of being related to terrorism" as some of the illicit activities conducted through the app. 

According to the document, the ministry requested that telecom companies "deploy solutions and measures to prevent Telegram's activities in Vietnam.” Following the release of the Reuters piece, the government announced the measures against Telegram on its website. 

"Telegram is surprised by those statements. We have responded to legal requests from Vietnam on time. This morning, we received a formal notice from the Authority of Communications regarding a standard service notification procedure required under new telecom regulations. The deadline for the response is May 27, and we are processing the request," the Telegram representative noted. 

According to a technology ministry official, the move was prompted by Telegram's failure to share customer information with the government when requested as part of criminal investigations.

The Vietnamese police and official media have regularly cautioned citizens about potential crimes, frauds, and data breaches on Telegram channels and groups. Telegram, which competes globally with major social networking apps such as Facebook's (META.O), WhatsApp and WeChat, remain available in Vietnam on Friday. 

Vietnam's ruling Communist Party maintains strict media censorship and tolerates minimal opposition. The country has regularly asked firms such as Facebook, Google (GOOGL.O), YouTube, and TikTok to work with authorities to remove "toxic" data, which includes offensive, misleading, and anti-state content. 

According to the document, Telegram has been accused of failing to comply with regulations requiring social media platforms to monitor, remove, and restrict illegal content. "Many groups with tens of thousands of participants were created by opposition and reactionary subjects spreading anti-government documents" based on police information. 

The free-to-use site, which has about 1 billion users globally, has been embroiled in scandals over security and data breaches, particularly in France, where its founder, Pavel Durov, was temporarily detained last year.
Read more »
zero-click
Mobile Security Spyware Threat Intelligence User Privacy Whatsapp Leak zero-click

Here's How to Safeguard Your Smartphone Against Zero-Click Attacks

 

Spyware tools have been discovered on the phones of politicians, journalists, and activists on numerous occasions over the past decade. This has prompted worries regarding the lack of protections in the tech industry and an unprecedented expansion of spyware technologies. 

Meta's WhatsApp recently stated that it has detected a hacking campaign aimed at roughly ninety users, the majority of whom were journalists and civil society activists from two dozen countries. 

According to a WhatsApp representative, the attack was carried out by the Israeli spyware company Paragon Solutions, which is now controlled by the Florida-based private equity firm AE Industrial Partners. Graphite, Paragon's spyware, infiltrated WhatsApp groups by sending them a malicious PDF attachment. It can access and read messages from encrypted apps such as WhatsApp and Signal without the user's knowledge. 

What is a zero-click attack? 

A zero-click attack, such as the one on WhatsApp, compromises a device without requiring any user activity. Unlike phishing or one-click attacks, which rely on clicking a malicious link or opening an attachment, zero-click leverages a security flaw to stealthily gain complete access after the device has been infected. 

"In the case of graphite, via WhatsApp, some kind of payload, like a PDF or an image, [was sent to the victims' devices] and the underlying processes that receive and handle those packages have vulnerabilities that the attackers exploit [to] infect the phone,” Rocky Cole, co-founder of mobile threat protection company iVerify, noted.

While reports do not indicate "whether graphite can engage in privilege escalation [vulnerability] and operate outside WhatsApp or even move into the iOS kernel itself, we do know from our own detections and other work with customers, that privilege escalation via WhatsApp in order to gain kernel access is indeed possible," Cole added. 

The iVerify team believes that the malicious attacks are "potentially more widespread" than the 90 individuals who were reported to have been infected by graphite because they have discovered cases where a number of WhatsApp crashes on [mobile] devices [they're] monitoring with iVerify have seemed to be malicious in nature.

While the WhatsApp hack primarily targeted civil society activists, Cole believes mobile spyware is a rising threat to everyone since mobile exploitation is more pervasive than many people realise. Moreover, the outcome is an emerging ecosystem around mobile spyware development and an increasing number of VC-backed mobile spyware companies are under pressure to become viable organisations. This eventually increases marketing competition for spyware merchants and lowers barriers that might normally deter these attacks. 

Mitigation tips

Cole recommends users to treat their phones as computers. Just as you use best practices to safeguard traditional endpoints like laptops from exploitation and compromise, you should do the same for phones. This includes rebooting your phone on a daily basis because most of these exploits remain in memory rather than files, and rebooting your phone should theoretically wipe out the malware as well, he said. 

If you have an Apple device, you can also enable Lockdown Mode. As indicated by Cole, "lockdown mode has the effect of reducing some functionality of internet-facing applications [which can] in some ways reduce the attack surface to some degree."

Ultimately, the only way to properly safeguard oneself from zero-click capabilities is to address the underlying flaws. Cole emphasised that only Apple, Google, and app developers may do so. "So as an end user, it's critically important that when a new security patch is available, you apply it as soon as you possibly can," the researcher added.
Read more »
User Privacy
Data Breach Google Privacy Lawsuit Texas User Privacy

Google to Pay Texas $1.4 Billion For Collecting Personal Data

 

The state of Texas has declared victory after reaching a $1 billion-plus settlement from Google parent firm Alphabet over charges that it illegally tracked user activity and collected private data. 

Texas Attorney General Ken Paxton announced the state's highest sanctions to date against the tech behemoth for how it manages the data that people generate when they use Google and other Alphabet services. 

“For years, Google secretly tracked people’s movements, private searches, and even their voiceprints and facial geometry through their products and services. I fought back and won,” Paxton noted in a May 9 statement announcing the settlement.

“This $1.375 billion settlement is a major win for Texans’ privacy and tells companies that they will pay for abusing our trust. I will always protect Texans by stopping Big Tech’s attempts to make a profit by selling away our rights and freedoms.”

The dispute dates back to 2022, when the Texas Attorney General's Office filed a complaint against Google and Alphabet, saying that the firm was illegally tracking activities, including Incognito searches and geolocation. The state also claimed that Google and Alphabet acquired biometric information from consumers without their knowledge or consent. 

According to Paxton's office, the Texas settlement is by far the highest individual penalty imposed on Google for alleged user privacy violations and data collecting, with the previous high being a $341 million settlement with a coalition of 41 states in a collective action. 

The AG's office declined to explain how the funds will be used. However, the state maintains a transparency webpage that details the programs it funds through penalties. The settlement is not the first time Google has encountered regulatory issues in the Lone Star State. 

The company previously agreed to pay two separate penalties of $8 million and $700 million in response to claims that it used deceptive marketing techniques and violated anti-competitive laws. 

Texas also went after other tech behemoths, securing a $1.4 billion settlement from Facebook parent firm Meta over allegations that it misused data and misled its customers about its data gathering and retention practices. 

The punitive restrictions are not uncommon in Texas, which has a long history of favouring and protecting major firms through legislation and legal policy. Larger states, such as Texas, can also have an impact on national policy and company decisions due to their population size.
Read more »
User Privacy
beWanted Data Breach Data Leak Job Platform User Privacy

Details of 1.1 Million Job Applicants Leaked by a Major Recruitment Platform

 

While looking for a new job can be enjoyable, it is surely not fun to lose your personal information in the process. In the meantime, the Cybernews investigation team found an unprotected GCS bucket belonging to the talent pool platform beWanted that had more than 1.1 million files.

The company, which has its headquarters in Madrid, Spain, bills itself as "the largest Talent Pool ecosystem in the world." beWanted is a software-as-a-service (SaaS) company that links companies and job seekers. The business maintains offices in the UK, Germany, and Mexico. 

The exposed instance was found by the researchers in November of last year. Despite the fact that the relocation temporarily affected service availability, beWanted claims that the company secured the bucket on May 9. 

"We prioritized data security. The solution was fully implemented, and the properly secured service was restored last Friday, May 9, 2025. We have been conducting exhaustive internal testing since Friday and can confirm that the solution is definitive. Furthermore, to the best of our knowledge and following relevant investigations, no data leakage has occurred," the company stated.

The researchers claim that resumes and CVs from job seekers make up the vast majority of the files from the more than a million compromised files. The information that was leaked included details that a job seeker would normally include such as Full names and surnames, phone numbers, email addresses, home addresses, dates of birth national id numbers, nationalities, places of birth, social media links, employment history and educational background. 

The researchers believe that a data leak involving over a million files, each of which likely represents a single person, is a serious security issue for beWanted. The fact that the data has been exposed for at least six months exacerbates the situation: hostile actors continue to comb the web for unprotected instances, downloading whatever they can find.

“This exposure creates multiple attack vectors, enabling cybercriminals to engage in identity theft, where personal information can be used to create synthetic identities or fraudulent accounts,” researchers added. 

Malicious actors can also use leaked information to create highly personalised and credible-looking phishing attempts, which could result in unauthorised access to financial accounts, passwords, or other sensitive data. 

Furthermore, the leaked information highlighted that the problem has worldwide implications. The leaked national ID numbers, for example, are from Spanish, Argentine, Guatemalan, Honduran, and other residents.
Read more »
User Privacy
Data Breach Data Leak IT Infrastructure Kelly Benefits User Privacy

Kelly Benefits Data Leak Affects 260,000 People

 

A Maryland-based outsourced benefits and payroll manager is notifying nine large customers and nearly 264,000 individuals that their private and sensitive data may have been compromised in a December hack. The number of impacted people has increased by eight-fold since Kelly & Associates Insurance Group, also known as Kelly Benefits, published an estimate of the hack's scope earlier this month. 

The company's current total of 263,893 affected persons is far higher than the 32,234 initially reported on April 9 to state regulators and the US Department of Health and Human Services as a HIPAA breach. 

The benefits company announced that it is sending breach notices to impacted individuals on behalf of nine clients: Amergis, Beam Benefits, Beltway Companies, CareFirst BlueCross BlueShield, Guardian Life Insurance Co., Intercon Truck of Baltimore, Publishers Circulation Fulfilment, Quantum Real Estate Management, and Transforming Lives. 

Kelly Benefits declined to comment, citing "the sensitive nature of the incident and subsequent investigation.” An investigation following the incident revealed that unauthorised access to the company's IT infrastructure occurred between December 12 and December 17, 2024. The company claimed that throughout that period, the attackers copied and stole specific files.

"Kelly Benefits then began a time-intensive and detailed review of all files affected by this event to determine what information was present in the impacted files and to whom it related," the company noted. It analysed internal records to match the individual with the relevant client or carrier. 

Individuals' information compromised in the event varies, but it could include their name, Social Security number, date of birth, medical information, health insurance information, or financial account information.

Kelly Benefits informed the FBI about the incident. This company stated that it is still reviewing its security policies, procedures, and technologies. At the time of writing, at least one proposed federal class action lawsuit against Kelly Benefits was filed in connection with the hacking incident. The lawsuit claims Kelly Benefits was negligent in failing to safeguard sensitive personally identifying information from unauthorised access.

"Even with several months of credit monitoring services, the risk of identity theft and unauthorized use of plaintiff's and class members' PII is still substantially high. Cybercriminals need not harvest a person's Social Security number or financial account information in order to commit identity fraud or misuse plaintiffs and the class's PII," the lawsuit notes. "Cybercriminals can cross-reference the data stolen from the data breach and combine with other sources to create 'Fullz' packages, which can then be used to commit fraudulent account activity on plaintiff and the class's financial accounts."
Read more »
User Privacy
Cyber Fraud IT Help Desk Marks & Spencer Social Engineering User Privacy

M&S Hackers Conned IT Help Desk Workers Into Accessing Firm Systems

 

Hackers who attacked Marks & Spencer and the Co-op duped IT professionals into giving them access to their companies' networks, according to a report.

The "social engineering" attack on the Co-op allowed fraudsters to reset an employee's password before infiltrating the network, and a similar method was employed against M&S, insiders told BleepingComputer. 

Hundreds of agency workers at Marks & Spencer were advised not to come to work as the retailer grappled with the aftermath of a hack that cost the business £650 million in a matter of days. 

The disruption started in April when click-and-collect orders and contactless payments were impacted. Stuart Machin, the CEO of M&S, confirmed the issue in a message to customers, stating that the retailer would be making "minor, temporary changes" to in-store operations while it dealt with the ongoing "cyber incident.” 

In order to counter the "social engineering" tactic employed by the hackers from the Scattered Spider network against the UK supermarkets, the National Cyber Security Centre (NCSC) has released new guidelines. 

“Criminal activity online — including, but not limited to, ransomware and data extortion — is rampant. Attacks like this are becoming more and more common. And all organisations, of all sizes, need to be prepared,” noted Jonathon Ellison, NCSC’s national resilience director, and Ollie Whitehouse, its chief technology officer, in a blog post. 

They have recommended firms to "review help desk password reset processes" and pay special attention to "admin" accounts, which typically have more access to a company's network. 

The Scattered Spider network is a group of young guys from the UK and the United States who gained popularity in September 2023 when they broke into and locked up the networks of casino companies Caesars Entertainment and MGM Resorts International, demanding large ransoms. 

Caesars paid approximately $15 million to rebuild its network. It specialises in "breaking down the front door" of networks before passing control to a "ransomware" group, which cripples the network and extorts its owner, according to the Times. 

Tyler Buchanan, a Scottish man accused of being a key member of the organisation, was extradited to the United States from Spain last month after being charged with attempting to hack into hundreds of companies, Bloomberg News reported, citing a US Justice Department official.

At the time of the assault, M&S stated that it is "working extremely hard to restart online and app shopping" and apologies for the inconvenience to customers. It has already been unable to process click and collect orders in stores due to the "cyber incident".
Read more »
Subscribe to: Posts (Atom)