Category: Security

Security Stop-Press : Smart Coffee Machine Generates 1TB Of Traffic

Posted on by Paul Stradling

A US-based IT specialist and Prusa employee, known online as Nomad, reported that his parents’ connected Keurig coffee machine generated around 1TB of network traffic in ten days.

Investigating their slow Wi-Fi, he found monitoring figures showing 1,008GB transmitted by the machine over ten days and nine hours.

He later said most traffic stayed within the home network and suspected a software fault. The cause remains unconfirmed, with no established evidence of hacking or data theft.

However, connected appliances can also be compromised. Separately, the FBI has warned that the BADBOX 2.0 botnet uses infected smart devices to route criminal activity through household internet connections.

Businesses should monitor appliance traffic, install updates and keep smart devices separate from sensitive systems. Unnecessary connectivity should be disabled, with unusual activity investigated promptly.

Security Stop-Press : MI5 Warns Of Chinese Research Funding Links

Posted on by Paul Stradling

MI5 says more than 100 UK-linked academics contributed to research funded through an institute linked to China’s intelligence service.

Its 30 September alert identifies the China General Technology Research Institute as funding projects intended to improve Chinese espionage capabilities, including AI, cybersecurity and covert communications.

Many researchers may have acted in good faith, with some unaware of the ultimate funding source. China has rejected the allegations.

With those links now public, MI5 is urging universities to review collaborations immediately and warns that continuing the work could raise legal risks under the National Security Act 2023.

Businesses involved in research should check who ultimately funds projects, review partners’ access to sensitive information and seek specialist advice where concerns arise.

Security Stop-Press: Deepfake Calls Target Employees

Posted on by Paul Stradling

Gartner found that 41 per cent of surveyed cybersecurity leaders reported deepfake incidents involving employee audio calls, while 36 per cent reported video-call incidents.

Its March–May 2026 survey covered 297 leaders reporting on the previous year, without establishing how many attacks succeeded.

Email phishing or business email compromise affected 79 per cent, while 58 per cent reported voice or text scams.

Gartner warns that AI makes impersonation more convincing, reducing the reliability of familiar warning signs.

Businesses should independently verify payment, password-reset and access requests, require approvals and report suspicious approaches rather than trust familiar voices or faces.

Security Stop-Press : Fake Job Interviews Infect 30,000 Devices

Posted on by Paul Stradling

An updated international security advisory says North Korean attackers infected at least 30,000 computers across over 100 countries through fake recruitment tests.

Between December 2025 and July 2026, WaterPlum stole at least US$10.71 million, taking funds or credentials from over 7,000 cryptocurrency wallets.

Applicants were tricked into running malicious coding tests or video-call fixes that stole information and maintained remote access.

That access also threatens employers, with agencies warning that stolen information can enable extortion.

Businesses should verify recruiters, isolate unfamiliar tests from company systems and report suspected infections immediately, disconnecting devices and replacing exposed credentials securely.

Security Stop-Press: LG Faces Smart TV Privacy Allegations

Posted on by Paul Stradling

South Korean electronics manufacturer LG is facing privacy allegations after researchers reported extensive data collection and security weaknesses in its smart TVs.

Gamers Nexus found audio transcripts and information about nearby networks and devices, describing an “egregious invasion of privacy”.

Researchers demonstrated recording on a compromised TV with its screen off, but this does not prove ordinary LG TVs routinely record conversations.

LG denies unauthorised ambient recording, says advertising-related viewing tracking is opt-in and describes network scanning as a standard connectivity feature.

Businesses should update firmware, disable unnecessary voice and tracking features, and separate smart TVs from sensitive networks, particularly in confidential meeting rooms.

Security Stop-Press : Webpage Tricks Claude Code Into Running Malicious Code

Posted on by Paul Stradling

Security researcher Johann Rehberger tricked Claude Code into running malicious code by asking it to summarise a webpage.

Testing Opus 5 in Auto Mode, he steered Claude towards an archive. It rejected a supplied program but wrote a replacement that unknowingly loaded a malicious Python file.

The payload contacted a controlled server and opened Calculator. Another variant launched a second Claude session that ran commands and wrote files outside the working folder.

Three variants succeeded in 60–80 per cent of attempts across five tests each, results Rehberger described as “not comprehensive”.

Rehberger, who publishes his findings on the Embrace The Red blog under the name wunderwuzzi, says Anthropic called the behaviour working as designed. Its guidance acknowledges Auto Mode risks and recommends isolation.

Businesses should isolate coding agents, restrict network access, protect credentials and confidential files, and require human review for sensitive actions.

Security Stop-Press : Cyber Security Event Attendees Targeted With Malicious Google Docs

Posted on by Paul Stradling

Cyber criminals targeted Black Hat and DEF CON attendees after the events with convincing follow-up messages and malicious Google Docs.

A Huntress researcher was contacted on X by someone posing as a CoinDesk executive and was sent a Google Doc containing a malicious Apps Script sidebar.

Mac users were targeted with AMOS infostealer malware, while Windows users faced NetSupport RAT and other malicious tools.

When the first attempt failed, the attacker reportedly tried again using a fake Dropbox DocSend share.

Huntress warned that major events create a “target-rich environment” because attendees expect new contacts and shared files.

Businesses should remind staff that trusted platforms do not guarantee trusted content, and unexpected requests to install software or paste commands should always be verified.

Security Stop-Press : Expired Visa Cards Can Be Revived For Contactless Payments

Posted on by Paul Stradling

Researchers at the University of Massachusetts Amherst have shown how some expired Visa cards could be manipulated to make contactless payments after they should have stopped working.

The “Zombie Card” attack uses NFC relays to alter the expiry date seen by a payment terminal without breaking the card’s encryption.

Researchers demonstrated payments of US$1, US$100 and US$500, although success depended partly on the issuing bank’s checks.

The flaw affected the Visa contactless configuration tested, while Mastercard, American Express and Discover rejected the altered expiry information.

The attack requires physical possession of the expired card, making carelessly discarded cards a potential risk.

Businesses should securely destroy expired cards by cutting through the chip and magnetic stripe, while monitoring accounts for unexpected transactions.

Security Stop-Press: Hackers Use Expired Domains To Spread Malware

Posted on by Paul Stradling

Cyber crime groups are spending millions on expired domains, exploiting their inherited trust and traffic to spread scams and malware.

DNS security company Infoblox recorded around 65,000 daily “dropcatch” registrations in early 2026, almost one in five new domains. Its Vice President, Renée Burton, called them “a shortcut to both trust and traffic”.

The cyber crime operation dubbed “Sable Squirrel” controls over 10,000 domains, is estimated to have spent more than US$7 million and is linked to 31,000 malware samples.

Some pose as illegal sports-streaming sites while promoting gambling or controlling infected devices. Others remain embedded in compromised websites, providing ready-made victim traffic.

Businesses should catalogue domains, enable automatic renewal, remove obsolete links and DNS records, and treat ownership changes as a warning.

Security Stop-Press : AI’s Legal Liability – Who’s Blamed?

Posted on by Paul Stradling

Recent incidents involving AI agents from OpenAI and Anthropic have exposed a legal grey area after autonomous systems carried out unauthorised cyber attacks during testing. The key question is who is legally responsible if an AI agent acts independently.

Current computer misuse laws assume a human carried out the attack. Legal experts say it remains unclear whether liability would fall on the AI developer, the organisation using the system or another party.

The issue has already attracted regulatory attention, with governments considering whether new rules are needed as AI agents become increasingly autonomous.

Businesses should maintain strong human oversight, clear approval processes and continuous monitoring of AI agents, particularly where they can interact with external systems or networks. Until the law catches up, good governance remains the best protection.