Security. In focus.

Researchers Make Scary Discovery About Apple’s Find My Network

Researchers at George Mason University have uncovered a way to exploit Apple’s Find My network, enabling the tracking of nearly any Bluetooth-enabled device by tricking the system into identifying it as a lost AirTag. The attack, called “nRootTag,” boasts a 90 per cent success rate and doesn’t require administrator access, making it both effective and accessible. Using affordable GPU rentals, attackers can manipulate cryptographic keys to track devices in real time, with experiments confirming its accuracy on items like laptops, e-bikes, and even devices on airplanes. Apple was informed of the vulnerability in July 2024 and has acknowledged it in security updates, though details on a fix remain unclear. Researchers recommend users update their devices regularly and limit Bluetooth permissions to mitigate risks.

German government denies foreign election interference was successful therecord.media/german-go…

The German government has denied claims by the chair of the Bundestag’s intelligence committee that the country’s recent federal election was “successfully manipulated” by foreign actors.

[..]

Germany’s security services warned on the last working day before the vote itself that fake videos circulating online purporting to reveal ballot manipulation in the country’s upcoming federal elections were part of a Russian information operation.

The fake videos appeared designed to foment discontent among supporters of the AfD by showing the party missing from ballot papers, or ballot papers marked in support of the AfD being shredded. The authorities assessed they were part of a campaign conducted by a Russian group tracked as Storm-1516, which Microsoft uncovered attempting to interfere in the U.S. presidential election last year.

The argument over measuring the effect of influence operations has been a contentious political issue for years, with many experts warning that overestimating their impact is effectively doing the adversary a favour.

UK silence over Apple ‘back door’ is unsustainable and unjustifiable, say experts therecord.media/apple-uk-…

The British government’s refusal to either confirm or deny any details about a legal notice targeting Apple’s cryptographic protections for iCloud accounts risks undermining domestic and international confidence in Westminster, experts have warned.

While the existence of the notice has not been avowed by either British officials or Apple, U.S. Director of National Intelligence Tulsi Gabbard has ordered a legal review of the secret directive and said she had a “grave concern” about its implications.

Since the initial report about the notice, Westminster has continued to repeatedly state it does “not comment on operational matters, including for example confirming or denying the existence of any such notices.”

Addressing Parliament earlier this week, Security Minister Dan Jarvis again declined to respond after the issue was raised by an MP, and said that not doing so was “a long-standing position held by successive Governments for obvious reasons of national security.”

But those “obvious reasons” have been challenged by comments from both within the U.K. intelligence community and from academic experts.

Fake CAPTCHA PDFs Spread Lumma Stealer via Webflow, GoDaddy, and Other Domains thehackernews.com/2025/02/5…

Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflow’s content delivery network (CDN) to deliver the Lumma stealer malware.

Netskope Threat Labs said it discovered 260 unique domains hosting 5,000 phishing PDF files that redirect victims to malicious websites.

“The attacker uses SEO to trick victims into visiting the pages by clicking on malicious search engine results,” security researcher Jan Michael Alcantara said in a report shared with The Hacker News.

“While most phishing pages focus on stealing credit card information, some PDF files contain fake CAPTCHAs that trick victims into executing malicious PowerShell commands, ultimately leading to the Lumma Stealer malware.”

The phishing campaign is estimated to have affected more than 1,150 organizations and more than 7,000 users since the second half of 2024, with the attacks primarily singling out victims in North America, Asia, and Southern Europe across technology, financial services, and manufacturing sectors.

Of the 260 domains identified to host the fake PDFs, a majority of them are related to Webflow, followed by those related to GoDaddy, Strikingly, Wix, and Fastly.

New White House Plan to Track Spending Raises Cyber Risks www.databreachtoday.com/new-white…

U.S. President Donald Trump ordered federal agencies to build new technology systems capable of tracking and justifying every single procurement across the U.S. government, the world’s largest buyer of goods. If it’s built, such a system could expose vast troves of sensitive data to hacking and foreign manipulation.

Trump signed an executive order Wednesday directing agencies to work with his Department of Government Efficiency to create such a system, mandating that it also include a justification for each payment. The system should have a mechanism for the agency head “to pause and rapidly review any payment.”

When agencies are forced to abruptly innovate without time to develop robust security architectures and conduct rigorous testing, they create an open invitation for attackers, former federal officials and public-sector cybersecurity experts told Information Security Media Group. That exact risk was what led to the creation of the U.S. Digital Service under the Obama administration - before it was rebranded last month as DOGE, largely driven by Trump and his mercurial multi-billionaire adviser, Elon Musk (see: Elon Musk’s Federal Worker Email Sparks ‘Security Nightmare’).

“The rush to build complex systems on the fly is a sure-fire recipe for disaster,” said Terry Dunlap, senior vice president at NetRise and a former global network vulnerability analyst at the National Security Agency. “Expect insecure code, unchecked vulnerabilities and supply chain pitfalls that could easily let malicious actors slip in undetected.”

Centralizing vast amounts of financial data would also create a high-value target - “a proverbial bullseye on the back of a government agency,” Dunlap said. Hackers, nation states or even rogue insiders could exploit such a repository to wreak havoc on economic stability, compromise sensitive intelligence or even disrupt national infrastructure, he warned.

“In short, it’s a cybersecurity dumpster fire waiting to happen,” he said.

Top 10 Most Probable Ways a Company Can Be Hacked www.darkreading.com/vulnerabi…

The Top 10

Understanding the following 10 root causes will help organizations implement a more informed and proactive data-driven cybersecurity defense…

AI-Fueled Tax Scams on the Rise www.darkreading.com/cyberatta…

As AI-driven scams surge this tax season, taxpayers face unprecedented challenges in safeguarding their personal and financial information. Taxpayers are increasingly targeted with plausible, highly convincing emails, texts and calls. In one alarming trend, fraudsters use AI-generated voice scams to impersonate IRS agents or tax professionals with voices and conversation that sound realistic. With the ability to create and widely spread these realistic voice scams, taxpayers have to be vigilant to ensure they don’t get tricked by scammers this year. According to a recent study conducted by LifeLock, the leader in identity theft protection in the U.S. and part of Gen™ (NASDAQ: GEN), 56% of individuals have already encountered AI-powered tax scams featuring realistic voices.

Police arrests suspects tied to AI-generated CSAM distribution ring www.bleepingcomputer.com/news/secu…

Law enforcement agencies from 19 countries have arrested 25 suspects linked to a criminal ring that was distributing child sexual abuse material (CSAM) generated using artificial intelligence (AI).

Operation Cumberland, coordinated by Danish law enforcement and supported by Europol, resulted in the seizure of 173 electronic devices and the identification of 273 suspected members tied to the criminal network.

Most individuals arrested during this joint action were apprehended on February 26, 2025, following 33 house searches around the world.

Vo1d malware botnet grows to 1.6 million Android TVs worldwide www.bleepingcomputer.com/news/secu…

A new variant of the Vo1d malware botnet has grown to 1,590,299 infected Android TV devices across 226 countries, recruiting devices as part of anonymous proxy server networks.

This is according to an investigation by Xlab, which has been tracking the new campaign since last November, reporting that the botnet peaked on January 14, 2025, and currently has 800,000 active bots.

In September 2024, Dr. Web antivirus researchers found 1.3 million devices across 200 countries compromised by Vo1d malware via an unknown infection vector.

Serbian police used Cellebrite zero-day hack to unlock Android phones www.bleepingcomputer.com/news/secu…

Serbian authorities have reportedly used an Android zero-day exploit chain developed by Cellebrite to unlock the device of a student activist in the country and attempt to install spyware.

Cellebrite is an Israeli digital forensics company that develops tools used by law enforcement, intelligence agencies, and private companies to extract data from smartphones and other digital devices.

Companies like Cellebrite commonly utilize zero-day exploits to access and extract data usually protected on locked phones.

The use of this Android exploit was found by Amnesty International’s Security Lab in mid-2024 during forensic research on the logs of the impacted device.

How to Prove to Auditors that You’ve Remediated CVEs in Kubernetes - Security Boulevard

Proving CVE remediation to auditors in Kubernetes environments requires a robust vulnerability management process. This process includes continuous scanning, prioritization, remediation planning and execution, and verification. Detailed documentation of the process, including policies, procedures, and records of remediation efforts, is crucial for demonstrating compliance and security to auditors.

4 ways to get your business ready for the agentic AI revolution | ZDNET

AI agents are poised to revolutionize business workflows, with experts predicting they will become the primary users of enterprise digital systems by 2030. To prepare for this transformation, businesses should identify valuable use cases, foster exploration and experimentation, adopt a partnership approach with business leaders, and be prepared to address challenges and potential failures.

Toronto Zoo says patrons' transaction data leaked on dark web in 2024 cyberattack | CBC News

The Toronto Zoo announced that a cyberattack in January 2024 resulted in the leak of transaction data, including names, addresses, and credit card information, for guests and members between 2000 and April 2023. The zoo stated that the compromised data was leaked on the dark web and advised affected individuals to be vigilant. Cybersecurity expert Francis Syms noted that while the zoo likely followed industry best practices, companies are increasingly moving sensitive data off the internet to mitigate cyberattack risks.

Microsoft disrupted a global cybercrime ring abusing Azure OpenAI Service

Microsoft exposed a global cybercrime ring, Storm-2139, that abused Azure OpenAI Service to create harmful content. The ring, composed of creators, providers, and users, used exposed credentials to bypass safeguards and generate illicit content, including non-consensual intimate images. Microsoft is taking legal action against the ring, disrupting their operations and curbing misuse of AI technology.

The New Face of Executive Protection: Why Digital and Physical Security Can No Longer Stand Alone - Cybersecurity Insiders

The security landscape for corporate leaders has changed, with threats evolving to exploit the divide between digital and physical security. To counter these hybrid threats, security teams need to integrate digital and physical protection programs, breaking down silos and establishing systematic monitoring of digital indicators. This includes monitoring social media sentiment, tracking mentions of executives across various web platforms, and protecting executive privacy and PII.

IBM closes $6.4B HashiCorp acquisition

Tokyo Government To Introduce Four-Day Workweek Next April

Tokyo will introduce a four-day workweek starting April 2025, allowing employees to take one weekday off weekly. This move aims to improve work-life balance and empower women, following similar initiatives by other local governments.

Marc Benioff says Salesforce will hire no engineers this year

Salesforce, led by CEO Marc Benioff, will not hire engineers this year due to the success of its AI agents, which are software programs that use AI to perform tasks. Benioff believes that companies of the future will have hybrid human and digital workforces, with AI agents playing a significant role. This move comes after Salesforce laid off over 8,000 employees in 2022 and 2023 while simultaneously hiring for roles focused on selling its AI agents.

Cloudflare’s 2024 Transparency Reports - now live with new data and a new format

Cloudflare’s 2024 Transparency Reports are now available, featuring new data points and a revamped format. The reports, reflecting Cloudflare’s commitment to transparency and evolving to meet the EU’s Digital Services Act (DSA) requirements, detail legal requests for customer information and Cloudflare’s abuse handling processes. The reports, divided into two parts for easier understanding, include machine-readable data and “additional context” boxes to highlight trends.

Belgium Investigating Intelligence Agency Hack by China

The Belgian government is investigating a suspected Chinese espionage campaign targeting the State Security Service. The hackers exploited a zero-day vulnerability in Barracuda email security appliances to access sensitive communications and staff information. This attack is part of a larger campaign by a Chinese hacking group, UNC4841, targeting government and technology organizations worldwide.

Cleveland Court Remains Closed After Cyber Incident

Cleveland Municipal Court has been closed for four days due to a cybersecurity incident. The court shut down affected systems as a precautionary measure and is working to restore services.

Federal government announces latest National Cyber Security Strategy | Data Protection Report

The Government of Canada announced its latest National Cyber Security Strategy (NCSS) on February 6, 2025. The NCSS aims to strengthen Canada’s cyber security resiliency through strategic partnerships, investments in innovation, and increased detection and disruption of cyber attacks.

Millions of Avast antivirus software customers are getting a refund. Here’s why. - CBS News

Avast is offering refunds to nearly 3.7 million customers who purchased antivirus software between 2014 and 2020. The FTC alleges Avast sold customer data without consent, contradicting claims of privacy protection. Consumers have until June 5 to file for a refund.

Apple might be forced to disable a key iPhone privacy feature in France - 9to5Mac

French authorities are expected to order Apple to disable its App Tracking Transparency feature and impose a fine. The investigation, which began in 2023, alleges Apple abused its dominant position by implementing discriminatory conditions for user data use.

3 Things to Know About AI Data Poisoning

Data poisoning, a cyberattack that corrupts AI training data, poses a significant threat to AI systems’ accuracy and reliability. Organizations must prioritize data security, elevating the role of the Chief Data Officer to mitigate risks. As AI adoption increases, organizations must prepare for data poisoning attacks, reevaluating their security strategies and investing in AI and ML system protection.